A composite beast for LAN security assessment.
NetChimera is a Python-based, modular framework for local network security testing, driven by a keyboard-controlled Terminal User Interface (TUI). The tool name is Inspired by the mythological chimera — a creature assembled from different animals — NetChimera fuses several distinct attack and analysis modules into a single toolkit, so you don't have to juggle half a dozen separate scripts and CLIs during an assessment.
Built with Rich and Blessed for the interface layer.
NetChimera includes ARP spoofing, DNS spoofing, MAC spoofing, and packet interception modules. These techniques can disrupt networks and intercept traffic that is not yours.
- Only use NetChimera on networks you own or have explicit written authorization to test.
- Unauthorized network interception, spoofing, or scanning is illegal in most jurisdictions (e.g. under the U.S. CFAA, UK Computer Misuse Act, and equivalent laws elsewhere).
- The authors and contributors accept no liability for misuse of this tool.
By using this project you agree to use it responsibly and legally.
NetChimera bundles the following modules behind a single TUI menu:
| Module | Description |
|---|---|
| HostMapper | Network discovery — sweeps the local subnet to identify live hosts |
| PortScanX | Port scanning against discovered or specified hosts |
| MAC Shade | Changes the MAC address of a local network interface |
| Interceptx (Passive) | Passive packet capture and analysis without altering network traffic |
| Interceptx (Active) | Active packet analysis combined with ARP spoofing to intercept traffic |
| ARPoisoning | Standalone ARP cache poisoning module for MITM positioning |
| DNSForge | DNS response spoofing on the local network |
Each module has its own submenu within the TUI, so you can configure and run it without leaving the tool.
- Python 3.9+
- Linux (raw socket / interface manipulation modules require root privileges and a Linux network stack)
- Root/sudo privileges for modules that touch raw sockets, interfaces, or ARP tables (MAC Spoof, ARP Spoof, Interceptx, DNS Spoof)
rich
blessed
scapy
mac-vendor-lookup
netfilterqueue
git clone https://github.com/esakki-raj-cybersec/NetChimera.git
cd NetChimera
python3 -m venv myenv
source myenv/bin/activate
pip install -r requirements.txt
sudo apt install libnetfilter-queue-devRun with elevated privileges since most modules require raw socket / interface access:
sudo python3 netchimera.pyNavigate the main menu with the arrow keys and press ENTER to open a module's submenu. Each submenu lets you configure module-specific options (target range, interface, spoofed identity, etc.) before running.
Navigation is fully keyboard-driven:
↑/↓— move between menu itemsENTER— select / drill into a submenuQ— exit the toolesc— Back to Mainmenu
Discovers live hosts on the local subnet (ARP/ICMP-based sweep) and displays IP/MAC/hostname/vendorname where available.
Scans specified hosts for open TCP/UDP ports. Useful for building a picture of services running on discovered hosts.
Changes the MAC address of a chosen network interface — useful for testing MAC-based access control or evading MAC filtering during authorized assessments.
- Passive mode: Captures and analyzes traffic on the local segment without modifying it.
- Active mode: Combines ARP spoofing with live traffic capture to position as a man-in-the-middle for deeper analysis.
Poisons ARP caches on target hosts to redirect traffic through the attacker-controlled machine.
Intercepts and forges DNS responses on the local network, redirecting resolution for chosen domains.
- Config file support for saved scan profiles
- Logging/export of session results (JSON/CSV)
- Plugin system for adding new modules
Issues and pull requests are welcome. Please open an issue first to discuss significant changes.
This project is licensed under the MIT License - see the LICENSE