> For the complete documentation index, see [llms.txt](https://heapbytes.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://heapbytes.gitbook.io/notes/active-directory/llmnr-poisoning.md).

# LLMNR poisoning

* LLMNR Stands for **Link Local Multicast Name Resolution.**

It's kinda like Man In the middle attack, where an attacker can get hash of a user.

<figure><img src="/files/4kV967PThlbfLVAaqipB" alt=""><figcaption><p>credit - TCM Security</p></figcaption></figure>

### Tools to attack/exploit:

1. Responder : [Responder GitHub Repository](https://github.com/lgandx/Responder)
2. Hashcat : To crack hashes that was taken with help of responder.

## References

{% embed url="<https://stridergearhead.medium.com/llmnr-poisoning-an-ad-attack-1265f5365332>" %}