Members Matasareanu Posted June 26, 2017 Members Report Posted June 26, 2017 Going Further with Responder's Basic Authentication There are a good number of situations when we find ourselves abusing the LLMNR and NBT-NS protocols on an infrastructure penetration test, more specifically on an Active Directory setup. These 2 protocols are enabled by default on most of the Windows operating systems. What are they doing is they facilitate the communication between network machines when searching for a DNS hostname regardless if it’s a share, a server or a web hostname. The overview picture of the attack vector: the victim is looking for a non-existing hostname the DNS server cannot resolve the request we reply and resolve the hostname resolution query we ask the victim for authentication 4 Quote
