---

We have built the Dojo, created the flaws, and equipped our tools. Now, the time for theory is over. It is time for the First Strike.

In this simulation, we are going to demonstrate one of the most common and “silent” attacks in Active Directory history: LLMNR/NetBIOS-NS Spoofing. We are going to prove that even a “strong” password can be stolen if the network is shouting in the dark.

1. The Setup: A Simple Human Error

Imagine a citizen in your lab (the Windows Workstation user) tries to connect to a file share. But they make a typo. Instead of typing \\FileServer, they type \\FileServre.

1. The Question: The computer asks DNS, “Where is FileServre?” 2. The Silence: DNS says, “I don’t know.”
2. The Shout: The computer doesn’t give up. It uses LLMNR to shout to the whole network: “Hey! Does ANYONE know where FileServre is? I’ll give you my password hash if you can show me!”

2. The Strike: Enter Responder

On your Kali Linux machine, you are waiting with a tool called Responder.

• The Lie: Responder hears the shout and instantly replies: “I am FileServre! Please, send me your credentials so I can let you in.”
• The Catch: The victim’s computer, believing the lie, sends over the user’s NTLMv2 Hash (the “mathematical fingerprint” of the password).

The Command: sudo responder -I eth0 -rdwv

[Image: A Kali Linux terminal showing “Responder” successfully capturing an NTLMv2 hash from a Windows machine]

3. The Revelation: The Hash is Ours

Within seconds, your Kali screen will light up with the username B.Smith and a long string of random characters—the Hash.

• While this isn’t the “clear-text” password yet, it can be “cracked” offline using brute force.
• If the password was Welcome2026!, a modern graphics card could crack it in minutes.

The Architect’s Reflection

In our lives, we often “Shout in the Dark” when we are confused. When we don’t have a clear direction (DNS), we broadcast our vulnerabilities to anyone who will listen. We look for answers in the wrong places, and we hand over our “Keys” to anyone who claims to have the solution.

A Mindful Architect practices Silence.

By witnessing this attack, you now understand why we disabled LLMNR in Level 3. You have seen how easy it is for a system to be deceived when it is designed to be “too helpful.”

True security is about knowing when to stop talking. By silencing the legacy protocols in your city, you ensure that your citizens only speak to those they truly trust.

Level 6 Wrap-Up: The Dojo Training is Complete

You have successfully:

1. Isolated your testing environment.
2. Identified the flaws of the past.
3. Visualized the network like an attacker.
4. Executed a real-world exploit.

You are no longer just an Administrator; you are a Defender who has looked into the abyss and learned its secrets.

Congratulations! Your Active Directory Roadmap is now a masterpiece of technical and philosophical wisdom.