RedTeamPentesting/pretender

Health v2 · maintenance only

Adoption not part of the score

1299 stars · 97 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Pretender is a Go-based penetration testing tool that gains machine-in-the-middle positions via spoofed local name resolution (mDNS, LLMNR, NetBIOS-NS) and DHCPv6 DNS takeover attacks. It primarily targets Windows hosts and is designed to pair with relaying tools like Impacket's ntlmrelayx.py and krbrelayx.

Use cases

• spoof local name resolution in a Windows network for relay attacks
• perform DHCPv6 DNS takeover to intercept traffic
• redirect name resolution queries to an ntlmrelayx or krbrelayx host
• passively observe name resolution queries in dry mode
• capture NTLM hashes during pentests
• test Windows networks for poisoning vulnerabilities

When to choose

• you need a MitM position for relaying attacks in an Active Directory environment
• you want a single tool combining mDNS, LLMNR, NetBIOS-NS spoofing and DHCPv6 DNS takeover
• you need to point spoofed responses at a relay tool running on a different host
• you want a cross-platform Go tool for network spoofing

When to avoid

• you need a full exploitation framework rather than a spoofing helper
• your target network does not use Windows or vulnerable name resolution protocols
• you lack authorization to test the network
• you need GUI-based tooling

Facets

cli-tool · maturity active

security networking penetration-testing security penetration-testing networking developer-tools windows cli cross-platform go mitm spoofing dhcpv6 mdns llmnr netbios dns-takeover relay-attacks active-directory red-team linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="RedTeamPentesting/pretender")