Inveigh is a cross-platform .NET machine-in-the-middle tool for penetration testers that conducts spoofing attacks and captures credentials across IPv4 and IPv6 networks.
The tool addresses the need to intercept network traffic and extract authentication material during penetration tests. It operates through two complementary methods: packet sniffing, which captures traffic directly from the network interface, and protocol-specific listeners that bind to network ports. The packet sniffing approach offers advantages including the ability to capture SMB NTLM challenge-response exchanges and reduced visibility through fewer port binds, though it requires elevated access. The tool supports attacks across multiple protocols including LLMNR, DNS, mDNS, NBNS, DHCPv6, ICMPv6, HTTP, HTTPS, SMB, LDAP, WebDAV, and proxy authentication.
Inveigh suits penetration testers who need flexible credential capture across multiple protocols in both Windows and Unix environments. The C# version is the primary implementation and has superseded the original PowerShell version. Windows users benefit from packet sniffing capabilities unavailable on other platforms, while Linux and macOS users can still leverage the protocol listeners. The tool compiles for multiple .NET versions including 3.5, 4.6.2, and 6.0, with cross-platform support available through .NET 6.0. On Windows, UDP listeners are configured to use port reuse, allowing them to operate on ports already in use by system services.
The project maintains both the legacy PowerShell implementation and an actively developed C# version. The C# codebase has been rebuilt as the primary version and continues to receive updates. The tool provides detailed configuration through parameters in Program.cs that users should review before compilation. Platform-specific limitations exist: packet sniffing is Windows-only due to raw socket differences, and macOS requires manual route configuration for multicast group participation in certain attacks.
