https://hackita.it/tags/llmnr-poisoning/Recent content in LLMNR Poisoning on Ethical Hacking | Pentest e Sicurezza Informatica | HackitaHugoitTue, 15 Sep 2026 00:00:00 +0000https://hackita.it/articoli/responder/Thu, 22 Jan 2026 00:00:00 +0000https://hackita.it/articoli/responder/<h1 id="responder-guida-pratica-a-poisoning-llmnrnbt-ns-ntlm-capture-e-relay" class="group/anchor-heading"> Responder: Guida Pratica a Poisoning LLMNR/NBT-NS, NTLM Capture e Relay <a href="#responder-guida-pratica-a-poisoning-llmnrnbt-ns-ntlm-capture-e-relay" class="text-inherit opacity-0 group-hover/anchor-heading:opacity-100 decoration-transparent">#</a> </h1><p>Responder forza sistemi Windows a rivelare le proprie credenziali sfruttando i meccanismi di fallback della risoluzione nomi (LLMNR, NBT-NS, mDNS) e connessioni SMB non verificate. In questa guida: setup → forced authentication → poisoning → capture NetNTLMv2 → cracking → relay → attack chain su Active Directory → troubleshooting.</p> <h2 id="responder-cheatsheet" class="group/anchor-heading"> Responder Cheatsheet <a href="#responder-cheatsheet" class="text-inherit opacity-0 group-hover/anchor-heading:opacity-100 decoration-transparent">#</a> </h2><table> <thead> <tr> <th>Obiettivo</th> <th>Comando</th> </tr> </thead> <tbody> <tr> <td>Analyze mode (passivo)</td> <td><code>responder -I eth0 -A</code></td> </tr> <tr> <td>Poisoning LLMNR/NBT-NS</td> <td><code>responder -I eth0 -wrf</code></td> </tr> <tr> <td>Attacco WPAD</td> <td><code>responder -I eth0 -wFb</code></td> </tr> <tr> <td>Verbose</td> <td><code>-v</code></td> </tr> <tr> <td>Interfaccia</td> <td><code>-I eth0</code></td> </tr> <tr> <td>Configurazione</td> <td><code>Responder.conf</code></td> </tr> <tr> <td>Log catturati</td> <td><code>logs/</code></td> </tr> <tr> <td>Relay (con MultiRelay)</td> <td><code>MultiRelay.py -t &lt;target&gt; -u ALL</code></td> </tr> </tbody> </table> <h2 id="cosè-responder-e-cosa-cattura-realmente" class="group/anchor-heading"> Cos&rsquo;è Responder e Cosa Cattura Realmente <a href="#cos%c3%a8-responder-e-cosa-cattura-realmente" class="text-inherit opacity-0 group-hover/anchor-heading:opacity-100 decoration-transparent">#</a> </h2><p>Responder è un tool di poisoning e rogue-service che risponde alle richieste di risoluzione nomi non autenticate (LLMNR, NBT-NS, mDNS) fingendosi la risorsa cercata, e mette in piedi server fake (SMB, HTTP, FTP, SQL, ecc.) per raccogliere l&rsquo;autenticazione che ne consegue.</p>