GO KALI FREE
IntermediateTools

Responder Guide: LLMNR/NBT-NS Poisoning Tool

A comprehensive guide to Responder for LLMNR, NBT-NS, and MDNS poisoning attacks, credential harvesting, and network authentication testing.

#responder#LLMNR#NBT-NS#poisoning#credential harvesting#windows security

Why You Need Responder

You are inside a Windows network and need to capture credentials without brute-forcing — Responder poisons LLMNR, NBT-NS, and MDNS requests to trick clients into sending their NetNTLM hashes. It is one of the fastest ways to obtain credentials in Active Directory environments during internal tests.

Prerequisites

  • Understanding of Windows networking and Active Directory
  • Knowledge of LLMNR, NBT-NS, and MDNS protocols
  • Same network segment as the target
  • Authorization for internal testing

    • How Responder Works

    When DNS fails, Windows broadcasts LLMNR or NBT-NS queries. Responder answers these queries, claiming to be the requested resource. The client authenticates to the attacker, sending NTLM hashes that can be captured and cracked.

    Installation

    # Already installed on Kali
sudo apt install responder

    Basic Usage

    sudo responder -I eth0

    Key Options

    | Option | Description |

    |--------|-------------|

    | -I INTERFACE | Network interface |

    | -r | Enable NBT-NS poisoning |

    | -w | Enable WPAD proxy |

    | -f | Fingerprint remote OS |

    | -v | Verbose mode |

    | -A | Analyze mode (no poisoning) |

    Targeted Attacks

    # LLMNR poisoning
sudo responder -I eth0 -rv

# WPAD attack
sudo responder -I eth0 -wF

# Analyze mode
sudo responder -I eth0 -A

    Real-World Example

    sudo responder -I eth0 -wrfv -o /home/kali/responder-logs
# Wait for hashes, then crack:
hashcat -m 5600 captured-ntlmv2.txt /usr/share/wordlists/rockyou.txt

    Common Mistakes

    Running without root. Not on the same broadcast domain. Leaving Responder running too long.

    Best Practices

    Use analyze mode first. Time attacks during business hours. Combine with Hashcat for cracking.

    Defensive Considerations

    Disable LLMNR via Group Policy. Disable NBT-NS. Use SMB signing.

    Related Tools

  • **Inveigh**: PowerShell poisoning tool
  • **Impacket**: Python network protocols
  • **CrackMapExec**: Active Directory tool

    • Related Articles

  • [Password Security Guide](/articles/password-security-guide)
  • [Metasploit Fundamentals](/articles/metasploit-fundamentals)

    • Summary

    Responder captures Windows credentials through LLMNR, NBT-NS, and MDNS poisoning. Effective use requires being on the same network segment and combining with hash cracking tools.

    Related SMB Tool Recommendations

  • [SMBClient](/tools/smbclient) - Verify share access and browse discovered SMB shares
  • [Enum4Linux](/tools/enum4linux) - Enumerate SMB users, groups, shares, and policies
  • [Enum4Linux-NG](/tools/enum4linux-ng) - Run modern SMB enumeration with structured output
  • [NBTScan](/tools/nbtscan) - Resolve NetBIOS names before deeper SMB testing
  • [CrackMapExec](/tools/crackmapexec) - Scale SMB enumeration across larger networks
  • [NetExec](/tools/netexec) - Use modern SMB and Active Directory automation

    • Knowledge Check

  • What protocols does Responder poison?
  • Why only the same broadcast domain?
  • What format are captured hashes?
  • What Hashcat mode for NetNTLMv2?
  • How to defend against Responder?

    • Frequently Asked Questions

    What is Responder used for?

    Responder is an LLMNR, NBT-NS, and MDNS poisoner that captures NTLMv2 hashes from Windows networks. It exploits name resolution fallback mechanisms to intercept authentication attempts and crack passwords offline with Hashcat.

    What protocols does Responder poison?

    Responder poisons LLMNR (Link-Local Multicast Name Resolution), NBT-NS (NetBIOS Name Service), and MDNS (Multicast DNS). These are fallback name resolution protocols Windows uses when DNS fails.

    Why must Responder be on the same broadcast domain?

    LLMNR, NBT-NS, and MDNS are layer-2 broadcast/multicast protocols that do not cross routers. Responder must be on the same subnet to receive and answer these broadcast queries.

    What format are captured hashes in?

    Captured hashes are saved in NTLMv2 format (NetNTLMv2), compatible with Hashcat mode 5600. The output files contain the username, domain, and the full NTLMv2 response for offline cracking.

    What Hashcat mode do I use for NetNTLMv2?

    Use Hashcat mode `-m 5600` for NetNTLMv2 hashes. Example: `hashcat -m 5600 captured.txt /usr/share/wordlists/rockyou.txt`.

    How do I defend against Responder attacks?

    Disable LLMNR and NBT-NS via Group Policy, enforce SMB signing, use DNS over HTTPS/TLS, and deploy network monitoring for anomalous name resolution responses.

    What does Responder's analyze mode do?

    Analyze mode (`-A`) detects LLMNR/NBT-NS/MDNS traffic on the network without poisoning. It shows which protocols are active and potential targets, useful for scoping before an engagement.

    What is a WPAD attack?

    WPAD (Web Proxy Auto-Discovery) attacks use Responder to serve a malicious PAC file via the `-w` flag. When clients request proxy settings, they receive a configuration routing traffic through the attacker's proxy.