2

I want to use the Responder tool during a pentest to find/show vulnerabilities in how the network is configured. But I am not sure how much effect it would have on the end-users aka the people I have to work with the rest of the year. I do not have the resources to set up a large scale test lab so I hoped people on this forum have some experience with this.

The tool: Responder

The attacks I want to try:

WPAD poisoning: responder -I eth0 -wft

WPAD poisoning with forced authentication.: responder -I eth0 -wFf

NBTNS poisoning: responder -I eth0 -rf

It can be that my definitions are a bit off but to be sure I'll explain what I want to get:

WPAD: IE tries to find the system proxy and so I send the victim my machine as proxy and let them reauthenticate. This can go automatically or with a popup in IE for the user to re-enter their credentials (that is the with forced authentication option). This should maximum give the victims a popup box for credentials.

NBTNS: Machines try to connect to fileshares on the network and I put myself in the middle. This should only sniff the hashes of the victims credentials.

My question is: What would the end users experience when running the commands that I described. Assuming that the network is not configured very securely.

Improve this question

2 Answers 2

Reset to default
1

I assume that you have the authorization to pentest your network in the scope you described. You may not only break operations but also expose information.

responder is a tool to, well, respond to requests. These requests may be benign (in some legacy environments there are LLMNR requests for some servers which are not in a domain) or business critical (where someone actually relies on the responses to these requests).

Your machine may not be able to process the requests of your users (either because of its configuration or performance, or other reasons). Your users will bypass the official proxy and therefore they will not be logged and/or filtered, which opens legal issues (depending on the country). Inversely, you may log their connexions, which may not be legal. Finally, you will may get their credentials, which again opens legal issues.

So your users may not get access to the resources your company provides and you may be at risk because you actively performed actions which may not be legal.

Improve this answer
3
  • Well let us say that the wuestion is the precursor to gaining authorization for this scope. But you are saying that the users would not be able to connect to shares as I am in the middle? That will make it hard to gain permission to execute this :P
    – Wealot
    Commented May 8, 2017 at 16:35
  • No, what I am saying is that the actions you want to perform may have unintended side effects which are difficult to assess without you analyzing how your machine will be able to handle the traffic normally provided by the proxy. Plus the extra features like logging and filtering. Plus the legal consequences of not doing this, or exposing the information. If you want to poison NBT-NS you should not be successful so there should be no issues (it depends on the system). But again, it would be useful to test for your specific systems in a visualized environment just to make sure.
    – WoJ
    Commented May 8, 2017 at 16:40
  • Thank you for your response. It is in my nature to just do, which isn't always the best action in our field :D. I talked to the admins and the conclusion is "no way" as it will crash production systems.... And I will research the privacy implications of sniffing credentials of users. So thanks for your reply! :D
    – Wealot
    Commented May 9, 2017 at 6:46
0

By the very nature of what Responder does, any queries that it answers usurps a legitimate server (LLMNR/NBTNS/WPAD) to answer that query, which means it will disrupt the workflow of such hosts/users.

Also, Responder can be caught. I wrote Respounder, which detects presence of Responder in the network. Hence its not a entirely covert operation.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .