I was reading about this device the author made, however he did not specify WHAT he was able to steal from a locked computer.

What credentials does this steal?


1 Answer 1


The article mentions that Responder is used, which is a tool for grabbing NTLM hashes from a variety of Windows protocols using LLMNR/NBT-NS/mDNS poisoning.

Basically, it takes advantage of the fact that many background connections are made by Windows, most of which rely on an identification/resolution protocol that has no guarantee you are talking to a legitimate server.

The same can also be done with a $10 Raspberry Pi Zero (or similar). Take a look at PoisonTap as well.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .