Shulou(Shulou.com)06/01 Report--

LLMNR spoofing tool Responder

LLMNR (Link-Local Multicast Name Resolution, Link Local Multicast name Resolution) protocol is based on DNS packet format. It resolves the host name to the IP address of IPv4 and IPv6. This allows users to access specific hosts and services directly using hostnames without having to remember the corresponding IP addresses. This protocol is widely used in Windows Vista/7/8/10 operating system.

The working mechanism of the agreement is very simple. For example, computer An and computer B are in the same local area network. When computer A requests host B, it first sends a UDP packet containing the requested hostname in broadcast form. After receiving the UDP packet, host B sends the response packet of UDP to host An in unicast form. Because the whole process is carried out in UDP, host A cannot confirm whether host B is the host corresponding to that host name at all. This creates the possibility of deception.

In response to this vulnerability, Kali Linux provides Responder tools. This tool can not only sniff all the LLMNR packets in the network and get the information of each host, but also initiate cheating to trick the requesting host into visiting the wrong host. In order to facilitate penetration, the tool can also forge HTTP/s, SMB, SQL Server, FTP, IMAP, POP3 and other services, so as to obtain service authentication information, such as user name and password, by phishing.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.