LLMNR Poisoning: How Windows Hands Out Password Hashes on the Network

Thu, 03 Sep 2026 08:00:00 -0300

Someone on the network types \\FILESRV into Windows Explorer — one wrong character, and no server by that name exists in DNS. Instead of returning an error and stopping there, Windows raises its hand and shouts out to everyone on the local network: "does anyone here go by FILESRV?" The attacker, listening in with Responder running on their laptop, replies immediately: "That's me." Windows accepts it, tries to authenticate — and hands over the logged-in user's NTLMv2 hash on a silver platter.

Local Network on Locodigital

LLMNR Poisoning: How Windows Hands Out Password Hashes on the Network