Conveigh
Conveigh is a Windows PowerShell LLMNR/NBNS spoofer detection tool.
Function
Invoke-Conveigh
- The main Conveigh LLMNR/NBNS spoofer detection function.
Privilege Requirements:
- Elevated Administrator shell
Features:
- Generates and sends IPv4 LLMNR/NBNS requests with random or set hostnames
- Detects responses to sent IPv4 LLMNR/NBNS requests using a packet sniffer
- Optionally displays all received IPv4 LLMNR/NBNS requests using a packet sniffer
- File output
- Run time control
Parameters:
- CaptureRequests - Default = Disabled: (Y/N) Enable/Disable displaying and logging all received LLMNR/NBNS requests.
- IP - Specify a specific local IP address for listening. This IP address will also be used for LLMNR/NBNS spoofing if the 'SpooferIP' parameter is not set.
- Hostnames - Array of hostnames that will be randomly selected for LLMNR/NBNS requests. Hostnames must meet NBNS hostname requirements. If this parameter is not used, hostnames will be randomly generated.
- MaxSendRequestTime - Default = 30 Minutes: Set the maximum random time in minutes for sending LLMNR/NBNS requests.
- FileOutput - Default = Disabled: (Y/N) Enable/Disable real time file output.