LLMNR Poisoning: An AD Attack

What is LLMNR?

• LLMNR Stands for Link Local Multicast Name Resolution.

• Used to identify host when DNS fails to do so.

• Previously known as NBT-NS.

• Key flaw is that the services utilize a user’s username and NTLMv2 hash when appropriately responded to.

STEPS:

Step 1: Run Responder python Responder.py -I tun0 -rdw

To read the full writeup go to my medium:

Click Here