LLMNR/NBT-NS Poisoning - from Linux | Notion

Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS)

LLMNR (Link-Local Multicast Name Resolution):
- Used when DNS fails.
- Allows local network hosts to resolve names via multicast.
- Uses UDP port 5355.
- Follows DNS-like format but operates on the local link.
NBT-NS (NetBIOS Name Service):
- Used when LLMNR fails.
- Resolves system names on a local network using NetBIOS names.
- Uses UDP port 137.

Both protocols provide fallback name resolution when DNS is unavailable.

Several tools can be used to attempt LLMNR & NBT-NS poisoning:

Tool	Description
Responder	Responder is a purpose-built tool to poison LLMNR, NBT-NS, and MDNS, with many different functions.
Inveigh	Inveigh is a cross-platform MITM platform that can be used for spoofing and poisoning attacks.
Metasploit	Metasploit has several built-in scanners and spoofing modules made to deal with poisoning attacks.

Both tools can be used to attack the following protocols: (Responder & Inveigh)

LLMNR
DNS
MDNS
NBNS
DHCP
ICMP
HTTP
HTTPS
SMB
LDAP
WebDAV
Proxy Auth