# RedTeamPentesting/pretender

Your MitM sidekick for relaying attacks featuring DHCPv6 DNS takeover as well as mDNS, LLMNR and NetBIOS-NS spoofing.

Repository: https://github.com/RedTeamPentesting/pretender
Canonical: https://ross.abutalabs.com/products/redteampentesting-pretender
Language: Go
License: MIT
License Family: permissive
Topics: go, mdns, dns, llmnr, netbios, security, dhcpv6, spoofer, pentesting, pretender, relaying
Last push: 2026-07-03T11:16:25+00:00

## Health v2 (maintenance only)
Score: 92/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 90, release rhythm 91, longevity 100
- inputs: {"age_days": 1514, "days_push": 61, "days_rel": 61, "gap_med": 8.5, "n_releases_24m": 5}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1299, forks 97 (observed 2026-08-28T04:04:17.372542+00:00)

## What it is
Pretender is a Go-based penetration testing tool that gains machine-in-the-middle positions via spoofed local name resolution (mDNS, LLMNR, NetBIOS-NS) and DHCPv6 DNS takeover attacks. It primarily targets Windows hosts and is designed to pair with relaying tools like Impacket's ntlmrelayx.py and krbrelayx.

## Use cases
- spoof local name resolution in a Windows network for relay attacks
- perform DHCPv6 DNS takeover to intercept traffic
- redirect name resolution queries to an ntlmrelayx or krbrelayx host
- passively observe name resolution queries in dry mode
- capture NTLM hashes during pentests
- test Windows networks for poisoning vulnerabilities

## When to choose
- you need a MitM position for relaying attacks in an Active Directory environment
- you want a single tool combining mDNS, LLMNR, NetBIOS-NS spoofing and DHCPv6 DNS takeover
- you need to point spoofed responses at a relay tool running on a different host
- you want a cross-platform Go tool for network spoofing

## When to avoid
- you need a full exploitation framework rather than a spoofing helper
- your target network does not use Windows or vulnerable name resolution protocols
- you lack authorization to test the network
- you need GUI-based tooling

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, networking, penetration-testing
- domain: security, penetration-testing, networking, developer-tools
- platform: windows, cli, cross-platform, go
- tags: mitm, spoofing, dhcpv6, mdns, llmnr, netbios, dns-takeover, relay-attacks, active-directory, red-team, linux, macos

## Member repositories
- RedTeamPentesting/pretender (main) score 92

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:17.372542+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:53:24.773123+00:00, confidence not recorded.
  - readme: https://github.com/RedTeamPentesting/pretender (fetched 2026-08-28T04:04:17.372542+00:00, sha 6a3861a29bc0)
- Data as of 2026-08-30T08:39:29.467469+00:00.