Which tool acts as a poisoner for LLMNR, NBT-NS, and MDNS to capture credentials?

Which tool acts as a poisoner for LLMNR, NBT-NS, and MDNS to capture credentials?

• A. Rubeus
• B. Responder
• C. Toggle-Case Attack
• D. Golden Tickets

Answer: (B)

Name-resolution poisoning targets LLMNR, NBT-NS, and MDNS by tricking clients into authenticating to a host controlled by the attacker. Responder is designed to exploit these protocols in a local network: it listens for name queries on those broadcast/multicast channels and immediately answers with forged responses for common names, causing clients to try to access services on the attacker's machine. When the client attempts to authenticate (typically using NTLM), credentials or hashes are captured by the attacker’s system. This makes Responder the go-to tool for credential harvesting through name-service poisoning. Other tools aren’t built for this specific spoofing technique. Rubeus focuses on Kerberos abuses and ticket handling rather than poisoning LLMNR/NBT-NS/MDNS. Golden Tickets pertain to forging Kerberos tickets, not capturing credentials via name resolution. Toggle-Case Attack describes a method related to evading detection or manipulating names, but it isn’t the standard tool used for poisoning these protocols to harvest credentials.

Name-resolution poisoning targets LLMNR, NBT-NS, and MDNS by tricking clients into authenticating to a host controlled by the attacker. Responder is designed to exploit these protocols in a local network: it listens for name queries on those broadcast/multicast channels and immediately answers with forged responses for common names, causing clients to try to access services on the attacker's machine. When the client attempts to authenticate (typically using NTLM), credentials or hashes are captured by the attacker’s system. This makes Responder the go-to tool for credential harvesting through name-service poisoning.

Other tools aren’t built for this specific spoofing technique. Rubeus focuses on Kerberos abuses and ticket handling rather than poisoning LLMNR/NBT-NS/MDNS. Golden Tickets pertain to forging Kerberos tickets, not capturing credentials via name resolution. Toggle-Case Attack describes a method related to evading detection or manipulating names, but it isn’t the standard tool used for poisoning these protocols to harvest credentials.