Guide · Agent skill

How to use the Man-in-the-Middle Attack Simulation agent skill

Updated 2026-10-29 · written with AI from the project's own documentation and checked against our catalogue data

This guide explains the Man-in-the-Middle Attack Simulation agent skill, a set of instructions and helper scripts that gives an AI agent a step-by-step playbook for simulating interception attacks on a network you are authorized to test. It is written for people who have not used agent skills before. By the end you will know what the skill does, how to install it, how to ask for it in plain language, and what safety conditions must be in place first.

Man-in-the-Middle Attack Simulationmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill

Quick start

1Get written authorization. Confirm in writing which targets, techniques and time window are approved. Do not start if the network or host is not in scope.
2Install the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder, or upload it under Settings → Capabilities → Skills in the Claude apps.
3Prepare the lab tools. Install Bettercap 2.x, Ettercap, mitmproxy, Wireshark or tshark, Python 3 with Scapy, and OpenSSL on a Linux machine with root access.
4Ask for a specific test. Describe the goal, the scope and your authorization in plain language, for example checking whether HSTS is enforced on a named internal host.
5Run the approved steps. Follow the agent's playbook one stage at a time, checking the interface, targets and gateway before each attack step starts.
6Verify detection and controls. Check whether certificate validation, HSTS and IDS or Zeek alerts caught the activity, and capture evidence with tshark.
7Clean up and document. Stop all attack modules, restore forwarding and firewall rules, remove the test CA, and record the results with file hashes.

What does this skill make the agent do?

The skill covers ARP spoofing, TLS interception with a test certificate authority, DNS spoofing and credential sniffing, using tools such as Bettercap, Ettercap and mitmproxy. It also includes a checklist for verifying whether certificate validation, HSTS and intrusion detection actually catch the activity.

It also includes a Python helper, scripts/agent.py, that performs ARP discovery, spoofing and sniffing with the Scapy library.

Set up IP forwarding and generate a test CA certificate with OpenSSL
Discover hosts and run ARP-based interception with Bettercap
Intercept HTTP and HTTPS traffic with mitmproxy
Test DNS spoofing and check detection with IDS, DAI and Zeek logs
Clean up the attack and document results

How do you install the skill?

Download the skill ZIP from this page. Then unzip it into one of two locations: ~/.claude/skills/ to make it available across your projects, or the .claude/skills/ folder inside a specific project to limit it to that project.

If you use the Claude apps instead, open Settings, go to Capabilities, then Skills, and upload the ZIP there.

Personal install: unzip into ~/.claude/skills/
Project install: unzip into .claude/skills/ inside the project folder
Claude apps: Settings → Capabilities → Skills, then upload the ZIP

How do you trigger the skill with a natural request?

You do not need a special command. Describe the task in plain language and say what kind of test it is, which network is in scope and that you have authorization. The agent can then match your request to the skill's use cases: checking TLS validation, showing the risk of cleartext protocols, validating HSTS or certificate pinning, testing detection of ARP or DNS spoofing, or training an incident response team.

Good requests name the goal and the scope. Vague requests such as 'hack the office network' are outside what this skill is for.

Our approved test window is open. Walk me through an ARP spoofing test against 192.168.1.50 on the lab segment and check whether our IDS alerts on it.
Check whether our internal app rejects a test CA certificate, meaning certificate pinning is working.
Verify that HSTS is enforced on our internal portal and show me the header evidence.
Explain how DNS spoofing would appear in our Zeek notice logs so we can write detection rules.

What do you need before running it?

The skill assumes a Linux attacker machine with root access, Layer 2 access to the target network segment, and written authorization that specifies in-scope targets and approved techniques. The source also expects an isolated lab or an approved test window with rollback procedures.

The toolset is Bettercap 2.x, Ettercap, mitmproxy, Wireshark or tshark, Python 3 with the Scapy library, and OpenSSL for generating the test CA. The helper script also uses the requests library for HSTS and SSL stripping checks.

Linux attacker machine with root access
Layer 2 access to the target segment
Written authorization and an isolated lab or approved test window
Bettercap 2.x, Ettercap, mitmproxy, Wireshark/tshark
Python 3 with Scapy (scripts/agent.py) and requests
OpenSSL for a test CA

How do you run the helper script?

The helper script scripts/agent.py has two documented modes. The first performs host discovery and cleartext detection on a network range. The second runs a full simulation against one target and its gateway.

Only run these on a segment you are authorized to test. The helper alters ARP tables on the target segment, so confirm the interface and addresses before you start.

python agent.py --network 192.168.1.0/24 --interface eth0 --duration 60
python agent.py --target 192.168.1.100 --gateway 192.168.1.1 --interface eth0

What should you do when the test ends?

The skill includes a clean-up sequence. Turn off each Bettercap module, restore IP forwarding, and remove the iptables rules you added. Confirm that target hosts relearn correct MAC addresses through normal ARP. Remove the test CA from any system where it was installed, and delete capture files that hold sensitive data as the engagement agreement requires.

Record the results. The skill suggests logging the run time and recording SHA-256 hashes of capture files in a report.

Turn off arp.spoof, http.proxy, https.proxy and dns.spoof in Bettercap
Restore net.ipv4.ip_forward to 0
Flush the iptables PREROUTING NAT rules you added
Remove the test CA from test systems and delete sensitive captures per the agreement

sudo sysctl -w net.ipv4.ip_forward=0
sudo iptables -t nat -F PREROUTING
sha256sum mitm_capture.flow mitm_evidence.pcapng >> mitm_report.txt

What people use it for

Testing whether a mobile or desktop app rejects a test CA, which shows whether certificate pinning is in place.
Checking that HSTS is enforced on an internal web portal before an audit.
Demonstrating to stakeholders why cleartext protocols such as FTP, Telnet and HTTP are risky on a shared segment.
Confirming that IDS, switch DAI or Zeek logs raise alerts when ARP or DNS spoofing happens in a lab.
Building a training exercise where an incident response team has to recognise MITM indicators.

Frequently asked questions

Is the Man-in-the-Middle Attack Simulation skill free to use?

The skill is published under the Apache-2.0 licence, as stated on this page. The underlying tools, including Bettercap, Ettercap, mitmproxy and Scapy, are separate projects with their own licences, which you should check before use.

What do I need to install to use this skill?

You need the skill ZIP from this page, unzipped into ~/.claude/skills/ or a project's .claude/skills/ folder, or uploaded under Settings → Capabilities → Skills. The attack steps also need a Linux machine with root access and the tools listed in the requirements section.

Can I use it on a production network?

The skill says not to use it on production networks without explicit written authorization and a rollback plan. The steps capture credentials and cookies and can disrupt live users, so an isolated lab or an approved test window is the safer choice.

Can a beginner with no networking background use it?

The skill is aimed at penetration testers, security teams and trainers. The commands change routing, ARP tables and firewall rules, and can break connectivity if misused, so you should understand networking and security before running them.

Why does the test show that my app rejected the traffic?

If the application rejects the test CA certificate, that suggests certificate pinning or strict validation is working. The skill's verification step checks the target for certificate errors to confirm this.

How is this different from running Bettercap or mitmproxy on their own?

The skill packages an ordered, documented playbook covering setup, attack, detection checks and clean-up, plus a Scapy helper script. Bettercap, Ettercap and mitmproxy still have to be installed and used on the attacker machine.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

Use this skill if you run approved penetration tests or lab exercises on networks you are authorized to test, and you want a structured playbook that also checks whether HSTS, certificate validation and IDS alerts work. Pick something else if you need a managed scanner, a tool with a graphical interface, or if you are new to networking, since the commands can disrupt connectivity.

Download the skill