Network Recon

Tools for mapping and attacking the LAN you’re connected to. All of them require an active WiFi connection — run connectwifi first — and are for your own / authorized networks only.

Discovery

Tool	Command	What it does
Net Discover	`nd`	ARP-scan the whole local /24 → table of live hosts (IP + MAC)
Net Spy	`ns` · [EXP]	Passive device recon on client-isolated networks (parses group ARP/DHCP/mDNS/SSDP — never transmits)

Scanning a host

Tool	Command	What it does
Port Scan	`ps` · `ps top`	TCP port scan (range or top-common), banner grab (`b`), and OS fingerprint
Ping	`pg`	ICMP echo × 4 with RTT + loss summary
SSH Client	`ssh` · `sc`	Interactive colour SSH terminal with scrollback
Default-Password Check	`dw`	Try factory/default creds on FTP/SSH/Telnet/HTTP/RTSP/Redis/MQTT/SNMP (or a custom `svc:port`) → `results.csv`
Chromecast Control	`ca`	Google Cast — discover, rickroll (DIAL), play media URLs / saved content, and share local SD photos/videos (Cast v2)

Targeting shortcut: after nd or ns, use the host index instead of typing an IP — e.g. ps top 0, pg 1, as ns3.

Attacks

Tool	Command	What it does
Iso Scan	`is` · [EXP]	Active isolation audit — GTK-inject to reach “isolated” clients, capture frames, reachability probes
ARP Spoof	`as`	L2 ARP cache poisoning → redirect + log the victim’s DNS/HTTP/HTTPS destinations
Responder	`rsp` · [EXP]	Poison LLMNR/NBT-NS/mDNS + fake HTTP/SMB login → capture NetNTLM hashes

Typical flow

CMD> cw MyWiFi     # 1. connect
CMD> nd            # 2. discover hosts        (or: ns  on isolated networks)
CMD> ps top 0      # 3. scan a host of interest
CMD> as ns3        # 4. (authorized) redirect a victim, or rsp to capture creds

Each tool has its own page (left) with full options, output files, and honest limits.