Responder – LLMNR, MDNS and NBT-NS Poisoner


Responder is an LLMNR, NBT-NS and MDNS poisoner. It will answer to specific NBT-NS (NetBIOS Name Service) queries based on their name suffix (see: NetBIOS Suffixes). By default, the tool will only answer to File Server Service request, which is for SMB.

Responder - LLMNR, MDNS and NBT-NS Poisoner

The concept behind this is to target our answers, and be stealthier on the network. This also helps to ensure that we don’t break legitimate NBT-NS behavior. You can set the -r option via command line if you want to answer to the Workstation Service request name suffix.

Features

  • Built-in SMB Auth server – Supports NTLMv1, NTLMv2 hashes with Extended Security NTLMSSP.
  • Built-in MSSQL Auth server – Supports NTLMv1 and LMv2 hashes.
  • Built-in HTTP Auth server – Supports NTLMv1, NTLMv2 hashes and Basic Authentication.
  • Built-in HTTPS Auth server – As above (comes with dummy keys).
  • Built-in LDAP Auth server – Supports NTLMSSP hashes and Simple Authentication (clear text authentication).
  • Built-in FTP, POP3, IMAP, SMTP Auth servers – Supports collection of clear text credentials.
  • Built-in DNS server – This server will answer type A queries, combine with ARP spoofing.
  • Built-in WPAD Proxy Server – Will capture all HTTP requests from IE users with “Auto-detect settings” enabled.
  • Browser Listener – This module allows you to find the PDC in stealth mode.
  • Fingerprinting – Will fingerprint every host who issued an LLMNR/NBT-NS query.
  • ICMP Redirect – For MITM on Windows XP/2003 and earlier Domain members.
  • Rogue DHCP – Supports DHCP Inform Spoofing.
  • Analyze mode – Allows you to see NBT-NS, BROWSER, LLMNR, DNS requests without poisoning.

Usage

Before starting take a look at Responder.conf and tweak it to your requirements.

You can download Responder here:

Responder-v2.3.0.zip

Or read more here.

Posted in: Hacking Tools, Networking Hacking, Windows Hacking


Latest Posts:


Sooty - SOC Analyst All-In-One CLI Tool Sooty – SOC Analyst All-In-One CLI Tool
Sooty is a tool developed with the task of aiding a SOC analyst to automate parts of their workflow and speed up their process.
UBoat - Proof Of Concept PoC HTTP Botnet Project UBoat – Proof Of Concept PoC HTTP Botnet Project
UBoat is a PoC HTTP Botnet designed to replicate a full weaponised commercial botnet like the famous large scale infectors Festi, Grum, Zeus and SpyEye.
LambdaGuard - AWS Lambda Serverless Security Scanner LambdaGuard – AWS Lambda Serverless Security Scanner
LambdaGuard is a tool which allows you to visualise and audit the security of your serverless assets, an open-source AWS Lambda Serverless Security Scanner.
exe2powershell - Convert EXE to BAT Files exe2powershell – Convert EXE to BAT Files
exe2powershell is used to convert EXE to BAT files, the previously well known tool for this was exe2bat, this is a version for modern Windows.
HiddenWall - Create Hidden Kernel Modules HiddenWall – Create Hidden Kernel Modules
HiddenWall is a Linux kernel module generator used to create hidden kernel modules to protect your server from attackers.
Anteater - CI/CD Security Gate Check Framework Anteater – CI/CD Security Gate Check Framework
Anteater is a CI/CD Security Gate Check Framework to prevent the unwanted merging of filenames, binaries, deprecated functions, staging variables and more.


Comments are closed.