evil-ssdp
Spoof SSDP replies to phish for NTLM hashes on a network
uncategorizedRed Team
TooluncategorizedredLinuxKali LinuxPlatforms: Linux · Last verified September 6, 2026
This tool responds to SSDP multicast discover requests, posing as a generic UPNP device on a local network. Your spoofed device will magically appear in Windows Explorer on machines in your local network. Users who are tempted to open the device are shown a configurable webpage.
Only use this tool against systems you own or are explicitly authorized to test — see the disclaimer.
Getting started
Install on Kali Linux with `sudo apt install evil-ssdp`. See the official Kali tool page and upstream homepage linked above for full usage and configuration details.
