Skill UI

A comprehensive guide for security professionals on detecting and preventing ARP spoofing and poisoning attacks. The skill covers multiple layers of defense, including implementing Dynamic ARP Inspection (DAI) on managed switches, utilizing ARPWatch for continuous monitoring, performing deep packet inspection with Wireshark, and developing custom Python scripts for real-time anomaly detection. Essential for mitigating Man-in-the-Middle (MitM) attacks at Layer 2.

This guide details how to simulate ARP spoofing attacks in controlled, authorized lab environments. It demonstrates Man-in-the-Middle (MITM) risks by poisoning the ARP cache, allowing users to test network detection capabilities (IDS/IPS, DAI) and validate the effectiveness of security controls like port security and 802.1X. This skill is strictly for authorized penetration testing and educational purposes.

This comprehensive playbook details advanced techniques for exploiting Layer 2 and Layer 3 network protocols. It covers attacks such as ARP spoofing, LLMNR/mDNS poisoning, WPAD abuse, DHCPv6 takeover, VLAN hopping, and STP manipulation. Designed for penetration testers, it facilitates MitM positioning, credential harvesting (NTLM relay), and robust network environment exploitation.