> For the complete documentation index, see [llms.txt](https://heapbytes.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://heapbytes.gitbook.io/notes/active-directory/llmnr-poisoning.md).

# LLMNR poisoning

* LLMNR Stands for **Link Local Multicast Name Resolution.**

It's kinda like Man In the middle attack, where an attacker can get hash of a user.

<figure><img src="https://2093681522-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8U5ZBZXak4T44Qt4GjMG%2Fuploads%2FzITfZZBizE6l6hoqrzVQ%2Fimage.png?alt=media&amp;token=ac700c0f-04e7-456c-8652-6000dede73a9" alt=""><figcaption><p>credit - TCM Security</p></figcaption></figure>

### Tools to attack/exploit:

1. Responder : [Responder GitHub Repository](https://github.com/lgandx/Responder)
2. Hashcat : To crack hashes that was taken with help of responder.

## References

{% embed url="<https://stridergearhead.medium.com/llmnr-poisoning-an-ad-attack-1265f5365332>" %}