PT0-001 · Question #10
A penetration tester wants to target NETBIOS name service. Which of the following is the MOST likely command to exploit the NETBIOS name service?
The correct answer is C. responder. Responder is the standard tool used to exploit NETBIOS Name Service by acting as a rogue NBT-NS and LLMNR responder to capture NTLM credential hashes on a network.
Question
A penetration tester wants to target NETBIOS name service. Which of the following is the MOST likely command to exploit the NETBIOS name service?
Options
- Aarpspoof
- Bnmap
- Cresponder
- Dburpsuite
How the community answered
(48 responses)- B4% (2)
- C94% (45)
- D2% (1)
Why each option
Responder is the standard tool used to exploit NETBIOS Name Service by acting as a rogue NBT-NS and LLMNR responder to capture NTLM credential hashes on a network.
arpspoof performs ARP cache poisoning at Layer 2 and does not interact with NETBIOS name resolution at all.
nmap is a port scanner and service enumerator - it can detect NBT-NS on port 137 but cannot exploit or poison the service.
Responder poisons NBT-NS (port 137) and LLMNR broadcast queries by responding to name resolution requests with the attacker's IP, causing victim machines to authenticate against the attacker's machine and leak NTLMv1/v2 hashes, which can then be cracked or relayed.
Burp Suite is an HTTP/HTTPS web application proxy and has no capability to interact with NETBIOS or NetBIOS Name Service traffic.
Concept tested: NETBIOS/LLMNR poisoning using Responder
Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-nbte/76eb8b67-9b80-4e52-8a01-a7a8f6aa8f88
Topics
Community Discussion
No community discussion yet for this question.