🖥️
Pentest Playbook
  • Pentest Playbook
  • Methodology
    • 🐘Pentest Methodology
  • Reconnaissance
    • 🦅Scanning and Enumeration
      • Host Discovery
      • Port Scan
  • Active Directory
    • 🐻Initial Attack Vectors
      • LLMNR Poisoning
      • SMB Relay
      • Gaining Shell Access
      • IPv6 Attack
    • 🐻‍❄️Post-Compromise Enumeration
      • LDAPDomainDump
      • BloodHound
      • PlumHound
      • PingCastle
    • 🐼Post-Compromise Attacks
      • CrackMapExec
      • SecretsDump
      • Kerberoasting
      • Token Impersonation
      • LNK File Attack
      • GPP or cPassword Attack
      • Mimikatz
  • Password Attacks
    • 🐱Hashcat
      • Hashcat for Windows
    • 🐠Hydra
    • 🐶John The Ripper
Powered by GitBook
On this page
  • Steps
  • Responder
  • Crack NTLMv2 Hashes
  1. Active Directory
  2. Initial Attack Vectors

LLMNR Poisoning

PreviousInitial Attack VectorsNextSMB Relay

Last updated 1 year ago

Steps

  1. Run Responder

  2. Wait for an event (SMB connection, User login, etc.)

  3. Capture Hashes

  4. Crack Hashes

Responder

General Usage: sudo responder -I [net interface] -dPv

sudo responder -I eth0 -dPv

Crack NTLMv2 Hashes

Refer to the Hashcat page under Password Cracking section:

🐻
Responder: Captured NTLMv2 Hash
NTLMv2 Hash