Defensive counterpart to https://github.com/SpiderLabs/Responder. The goal of this project is to conduct defense through deception in the case of an attacker running a MDNS poisoner, such as Responder, by feeding them false credentials.

Usage of ./Requestor:
  -auth-method string
        Web authentication method to send the credential with. Supported: Basic, NTLM (default "basic")
  -interval int
        Interval between requests, in minutes. (default 5)
  -interval-deviation int
        Tolerable deviation from the specified interval, in seconds. (default 45)
  -query-target string
        The hostname to query with the .local TLD. (default "wpad")
  -username string
        The username for the fed credential. (default "LocalAdmin")

• Query target should be a realistic, but invalid hostname to send credentials to. The default is wpad, but other good values might be "mailserver" or "adfs".
• Your environment should be set up to alert defenders when an attacker tries to use the specified username.

TODO:

• Fire alert (webhook) when poisoning is detected
• Allow specification of the user-agent
• Utilize configuration file instead of CLI-only.