search

lawndoc / Respotter

Respotter is a Responder honeypot! Catch attackers as soon as they spin up Responder in your environment.
MIT License
166 stars 10 forks source link

Bug: NBNS traffic broadcast IP is wrong #7

Closed lawndoc closed 2 months ago

lawndoc commented 3 months ago

The broadcast IP 255.255.255.255 isn't broadcasting packets in the test environment, but it does work when we use the local broadcast IP (172.19.0.255). We will probably have to dynamically find the broadcast IP at runtime.

This gets complicated if there are multiple active interfaces. Right now, I think we should just broadcast the packet on all interfaces. Eventually we will need to support multiple interfaces anyways for deployment purposes, so broadcasting on all interfaces seems like it might kill 2 birds with 1 stone.

lawndoc commented 3 months ago

Manually creating and using SuperSockets is probably the way to do this.

lawndoc commented 3 months ago

The SuperSockets idea failed when I tried it for another bug fix. I'll circle back to this later. For now it's fine to just set the broadcast IP manually.

lawndoc commented 2 months ago

We have an okay-ish solution to this for now. It's not automatic, but you can specify the subnet via argv or config file at runtime which will calculate the broadcast IP.