Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1557.002_arp-cache-poisoning
Adversaries may poison Address Resolution Protocol (ARP) caches to position themselves between the communication of two or more networked devices.
Passed 18 of 22 test cases with the skill, and 12 of 22 without it.
and 4 more in the full report
6 fixed12 passed either way4 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
What severity rating and primary finding classification should be recorded in a standardized risk assessment matrix when ARP cache poisoning susceptibility is verified?
| Checked | Without skill | With skill |
|---|---|---|
| Assigns High severity. | Passed | Passed |
| Identifies the risk impact as Credential Access. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1557
Adversaries may poison Address Resolution Protocol (ARP) caches to position themselves between the communication of two or more networked devices. This activity may be used to enable follow-on behaviors such as Network Sniffing or Transmitted Data Manipulation.
The ARP protocol is used to resolve IPv4 addresses to link layer addresses, such as a media access control (MAC) address. Devices in a local network segment communicate with each other by using link layer addresses. If a networked device does not have the link layer address of a particular networked device, it may send out a broadcast ARP request to the local network to translate the IP address to a MAC address. The device with the associated IP address directly replies with its MAC address. The networked device that made the ARP request will then use as well as store that information in its ARP cache.
An adversary may passively wait for an ARP request to poison the ARP cache of the requesting device. The adversary may reply with their MAC address, thus deceiving the victim by making them believe that they are communicating with the intended networked device. For the adversary to poison the ARP cache, their reply must be faster than the one made by the legitimate IP address owner. Adversaries may also send a gratuitous ARP reply that maliciously announces the ownership of a particular IP address to all the devices in the local network segment.
The ARP protocol is stateless and does not require authentication. Therefore, devices may wrongly add or update the MAC address of the IP address in their ARP cache.
Adversaries may use ARP cache poisoning as a means to intercept network traffic. This activity may be used to collect and/or relay data such as credentials, especially those sent over an insecure, unencrypted protocol.
Platforms: Linux, Windows, macOS
Identify Attack Surface: Determine if the target environment is susceptible to ARP Cache Poisoning by examining the target platforms (Linux, Windows, macOS).
Assess Existing Defenses: Review whether mitigations for T1557.002 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
test cases passed, vs 12 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.