Got-Responded is a simple tool to detect NBT-NS and LLMNR spoofing and messing with them a bit. Pentesters, Redteamers and even real attackers love to use tools like Responder to spoof LLMNR and/or NBT-NS responses.
There are some awesome other tools to help with detection, such as respounder. But I wanted to figure it out for myself, and at the same time add a way to push “honey” tokens (fake AD credentials) to people using these spoofing tools.
Also Read – FIR : Fast Incident Response
How to install
git clone https://github.com/joda32/got-responded.git
cd got-responded
python3 -m venv responded-env
source responded-env/bin/activate
pip install -r requirements.txt
How to use it
Simple mode
This will start it in default mode, will check for both LLMNR and NBT-NS spoofing, but will not send fake SMB creds
python got-responded.py
The sort command in Linux reads lines from files or standard input and writes them to standard…
The wall command in Linux sends a message to the terminals of all currently logged-in users. The…
journalctl queries logs collected by systemd-journald, the systemd logging daemon. It gives you structured access to kernel…
The stat command in Linux displays detailed metadata about files and filesystems. Where ls gives a condensed summary suitable…
In Linux, groups organize user accounts and define shared access to files and resources. Every…
The touch command in Linux does two things: it creates new empty files, and it updates the…