skills/mukul975/anthropic-cybersecurity-skills/conducting-man-in-the-middle-attack-simulation/Gen Agent Trust Hub
conducting-man-in-the-middle-attack-simulation
Warn
Audited by Gen Agent Trust Hub on Apr 10, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Modifies system-level network configurations using sudo sysctl and sudo iptables to enable IP forwarding and NAT redirection.
- [COMMAND_EXECUTION]: Executes network-level attacks including ARP spoofing, DNS spoofing, and DHCP spoofing via the scripts/agent.py script and tools like Bettercap and Ettercap.
- [DATA_EXFILTRATION]: Intercepts and logs potentially sensitive network traffic, including POST request data (credentials) and authentication cookies, to local log files through mitmproxy and scapy.
- [PROMPT_INJECTION]: Ingests untrusted network data from packets captured via scapy.sniff() and mitmproxy scripts.
- Ingestion points: Network interface sniffing via scapy and transparent proxying via mitmproxy.
- Boundary markers: Absent in script output and logging logic.
- Capability inventory: Packet modification (send), system configuration (sudo), and local file writing.
- Sanitization: No sanitization of captured data before logging or display.
Audit Metadata