Kevin-Robertson/Inveigh

Health v2 · maintenance only

Adoption not part of the score

3014 stars · 473 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Inveigh is a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool for penetration testers, with a primary C# version and a legacy PowerShell version. It performs spoofing attacks and captures hashes/credentials via packet sniffing and protocol-specific listeners for protocols like LLMNR, mDNS, NBNS, DHCPv6, HTTP(S), SMB, LDAP, and WebDAV.

Use cases

• capture NTLM challenge/response hashes on a Windows network
• spoof LLMNR, mDNS, and NBNS name resolution during a pentest
• run a machine-in-the-middle attack over IPv4 and IPv6
• capture credentials through HTTP, HTTPS, SMB, LDAP, and WebDAV listeners
• perform DHCPv6 and ICMPv6 spoofing attacks
• run credential capture tooling on Linux or macOS with .NET 6

When to choose

• you are a penetration tester needing an active spoofing and hash capture tool on Windows or cross-platform .NET
• you want both packet sniffing and listener-based capture methods
• you need IPv6 attacks like DHCPv6 and ICMPv6 alongside IPv4 name resolution spoofing

When to avoid

• you need a passive-only network monitoring tool without spoofing
• you are on Linux/macOS and require packet sniffing, which is Windows-only
• you lack authorization to perform machine-in-the-middle attacks on the target network

Facets

cli-tool · maturity active

penetration-testing security networking penetration-testing security networking windows windows cross-platform dotnet cli mitm spoofing ntlm credential-capture llmnr mdns nbns dhcpv6 smb powershell red-team linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="Kevin-Robertson/Inveigh")