Skip to main content
Windows falls back to broadcast name resolution (LLMNR, NetBIOS Name Service, mDNS) whenever DNS can’t resolve a name, every host on the segment gets asked “does anyone know this name?” and answers blindly trust whoever responds first. Poisoning these broadcasts means answering on behalf of a name nobody actually owns, the victim then authenticates to the attacker directly, handing over a crackable NetNTLMv2 hash without ever touching the real target.
This is credential capture, not enumeration, that’s why it’s split out from AD Enumeration (Unauthenticated) even though it needs no domain creds either.

​
Poisoning

CommandDescription
sudo responder -I eth0The standard Linux tool, answers LLMNR/NBT-NS/mDNS queries and captures the resulting NTLM hashes to crack offline.
sudo mitm6 -d <domain>Same idea over IPv6: answers DHCPv6 queries to become the victim’s IPv6 DNS server, then abuses WPAD to capture NTLM hashes. Effective even on networks that have LLMNR/NBT-NS disabled, since IPv6 is enabled by default.
Import-Module .\Inveigh.ps1
Invoke-Inveigh Y -NBNS Y -ConsoleOutput Y -FileOutput Y		Inveigh: the Responder equivalent for when the attack needs to run from a Windows host instead of Linux.
.\Inveigh.exeCompiled C# version of the same tool, useful when PowerShell execution is restricted.

​
Forcing Authentication

Rather than waiting for a broadcast to poison, a planted file can directly trick anyone browsing a share into authenticating to an attacker controlled UNC path, full breakdown (SCF, LNK, URL, library/search-connector files) on Malicious Files for NTLM Capture.

​
Quick Reference Tools

Responder

The primary LLMNR/NBT-NS/mDNS poisoning tool, used above.

mitm6

IPv6-based alternative, effective even when LLMNR/NBT-NS is disabled.

Inveigh

Windows-native equivalent of Responder.