{"id":1217,"date":"2024-12-14T07:28:56","date_gmt":"2024-12-14T07:28:56","guid":{"rendered":"https:\/\/hackmybox.com\/?p=1217"},"modified":"2025-09-08T16:28:27","modified_gmt":"2025-09-08T16:28:27","slug":"active-directory-enumeration-attacks","status":"publish","type":"post","link":"https:\/\/hackmybox.com\/index.php\/2024\/12\/14\/active-directory-enumeration-attacks\/","title":{"rendered":"Active Directory Enumeration & Attacks"},"content":{"rendered":"

(Insights from HTB Academy)<\/strong><\/span><\/h3>

Part 1: LLMNR\/NBT-NS Poisoning<\/span><\/h2>

Securing Active Directory (AD) is crucial for safeguarding a network's identity management system, which organizes and manages users, computers, and resources<\/span>. AD security involves practices like restricting user access through least privilege, enforcing Group Policies,<\/span> and conducting routine audits and monitoring of network activities.<\/p>

Ensuring secure communication between AD components, applying security patches, and maintaining proper network segmentation are vital for protection. Regular updates and vulnerability assessments<\/span> are essential to address potential security gaps.<\/p><\/div><\/div>

Responder is a tool used for poisoning network protocols and capturing authentication hashes (which are used in attacks like Man-in-the-Middle). It displays messages about the requests it intercepts, such as NTLM hashes<\/span>, LLMNR<\/span>, and NBT-NS<\/span> requests.<\/p>

  1. First run the command : sudo responder -I ens224<\/span><\/li><\/ol>

    -I ens224:<\/span> This specifies the network interface (ens224) that Responder will listen to. You should replace ens224 with the actual interface name on your system (you can find the interface name using the ifconfig or ip a command).<\/p><\/div><\/div>

    \"\"<\/div><\/div>