Sniffing & Spoofing
Getting in the middle of network traffic: packet capture and analysis, ARP/LLMNR poisoning, and general MITM tooling.
| Tool | Source | Notes |
|---|---|---|
| wireshark-qt | official | Packet capture/analysis |
| ettercap | official | MITM/network sniffer-interceptor (console) |
| bettercap | official | Network attack/monitoring swiss-army-knife |
| responder | aur | LLMNR/NBT-NS/mDNS poisoner + rogue auth server (NTLM capture) |
Several of these tools need to touch a raw socket, which requires root — that’s exactly the kind of tool the Security Tools Menu’s help-first behavior exists for: you see usage first, not a silent permission-denied.