GO KALI FREE

Responder

Sniffing & Spoofing

Intermediatehigh risk

Responder is an LLMNR, NBT-NS and MDNS poisoner. It responds to specific localized name resolution requests with rogue authentication challenges to harvest hashes and credentials.

Installation

sudo apt install responder

Basic Syntax

sudo responder -I <interface> [options]

Quick Facts

Full Name
Responder
License
GPL v3
Written In
Python
Platforms
Linux
Category
Network Poisoning
Protocols
LLMNR, NBT-NS, MDNS, DHCP, WPAD
First Release
2013
Author
Laurent Gaffié

Tool Overview

Responder is a powerful network poisoning tool that exploits Windows name resolution protocols to capture credentials. It listens for LLMNR, NBT-NS, and MDNS queries and responds with spoofed answers, tricking Windows systems into authenticating against rogue servers.

Developed by Laurent Gaffié, Responder has become an essential tool for penetration testers targeting Active Directory environments. It includes rogue HTTP, SMB, SQL, FTP, LDAP, DNS, and WPAD servers that capture NTLMv1 and NTLMv2 hashes, which can then be cracked offline.

When combined with tools like Hashcat or ntlmrelayx, Responder provides a complete workflow for credential harvesting and relay attacks. It is particularly effective in Windows-dominated networks where LLMNR and NBT-NS are enabled by default.

Common Commands

sudo responder -I eth0Standard poisoning - Analyze and respond to network name requests on interface eth0
sudo responder -I eth0 -w -r -fFull configuration - Enable WPAD rogue proxying, NetBIOS name resolution, and fingerprinting
sudo responder -I eth0 -APassive mode - Monitor and log local LLMNR/NBT-NS traffic without sending poison responses
sudo responder -I eth0 -P -vForce proxy auth - Prompt for cleartext credentials using basic HTTP authentication proxy windows
responder -I eth0Basic poisoning
responder -I eth0 -wrfFull attack mode
responder -I eth0 -AAnalyze mode
sudo responder -I eth0 -wFForce auth - Enable WPAD and force NTLM auth on captured requests
sudo responder -I eth0 -dwvFull poisoning - DHCP, WPAD, and verbose logging together
cat /usr/share/responder/logs/Responder-Session.logReview log - Read the session log of captured events
ls /usr/share/responder/logs/*NTLMv2*Find hashes - Locate captured NTLMv2 hash files for cracking
sudo responder -I eth0 -bBasic auth - Serve HTTP Basic auth to capture cleartext credentials

Step-by-Step Guide

  1. 1Determine which network adapter connects to your target environment
  2. 2Launch the script using elevated permissions
  3. 3Watch the terminal output for incoming authentication attempts
  4. 4Retrieve the captured cryptographic data from the application's storage directory
  5. 5Transfer the data to a dedicated cracking rig to attempt recovery

Warnings

Use Cases

LLMNR Poisoning

Poison Link-Local Multicast Name Resolution queries to capture Windows authentication hashes.

NBT-NS Poisoning

Exploit NetBIOS Name Service broadcasts to intercept legacy Windows authentication requests.

WPAD Attack

Rogue Web Proxy Auto-Discovery server that forces browsers to proxy through your system.

MDNS Spoofing

Poison Multicast DNS queries used by macOS and Linux systems for credential capture.

SMB Relay Preparation

Capture NTLM challenges for relay attacks against other systems on the network.

Credential Harvesting

Collect NTLM hashes for offline cracking with Hashcat or John the Ripper.

Related Tools

Metasploit

Exploitation

Impacket

Exploitation

Bettercap

Sniffing & Spoofing

Aircrack-ng

Wireless Attacks

Wireshark

Sniffing & Spoofing

Frequently Asked Questions

What is Responder used for?

Responder poisons LLMNR, NBT-NS, and MDNS name resolution requests to capture NTLMv1 and NTLMv2 hashes from Windows systems. It sets up rogue authentication servers that intercept and log credentials when systems fail to resolve names.

How does Responder capture hashes?

When a Windows system tries to resolve a hostname and fails DNS, it falls back to LLMNR or NBT-NS broadcasts. Responder answers these broadcasts, claiming to be the target, and initiates NTLM authentication — capturing the hash in the process.

Can Responder crack captured hashes?

No, Responder captures hashes but does not crack them. Use Hashcat or John the Ripper to crack captured NTLM hashes offline, or use Relay attacks with tools like ntlmrelayx.

Is Responder still effective on modern Windows?

Modern Windows versions still use LLMNR and NBT-NS fallback by default. However, Group Policy can disable these protocols, and EDR solutions can detect Responder activity.

How does LLMNR/NBT-NS poisoning work?

When DNS resolution fails, Windows broadcasts LLMNR or NBT-NS queries on the local network. Responder listens for these broadcasts and sends spoofed responses claiming to be the requested host, causing the victim to authenticate against Responder's rogue server and reveal their NTLM hash.

How does Responder capture credentials?

Responder runs rogue HTTP, SMB, SQL, FTP, LDAP, DNS, and WPAD servers that respond to authentication requests. When victims attempt to access these services, their NTLM hashes are captured and logged to files for offline cracking.

What is NTLM relay and how does it relate to Responder?

NTLM relay captures NTLM authentication challenges and forwards them to other systems on the network for authentication. Responder can work with ntlmrelayx to relay captured hashes to other machines, enabling lateral movement without cracking passwords.

How does WPAD spoofing work in Responder?

Responder acts as a rogue Web Proxy Auto-Discovery (WPAD) server that responds to WPAD queries from clients. This forces browsers to route traffic through Responder's proxy, allowing interception of HTTP traffic and capture of authentication credentials.

Can Responder perform IPv6 attacks?

Yes, Responder supports IPv6 poisoning attacks including router advertisement spoofing and NDP-based man-in-the-middle attacks. These techniques can intercept traffic on IPv6 networks and capture credentials from systems using IPv6 name resolution.

How can I detect Responder on my network?

Monitor for unusual LLMNR/NBT-NS traffic spikes, detect rogue DHCP and DNS responses, look for unauthorized SMB servers, and deploy EDR solutions that can identify Responder's signature behavior. Network segmentation also limits Responder's effectiveness.

How do I configure Responder to only capture specific hashes?

Edit /usr/share/responder/Responder.conf to disable specific servers (HTTP, SMB, SQL, etc.) and only enable the protocols you want to capture. You can also use -I to specify which network interface to listen on.

Can Responder capture NTLMv1 hashes?

Yes, Responder captures both NTLMv1 and NTLMv2 hashes. NTLMv1 hashes are easier to crack but are rarely seen on modern Windows. NTLMv2 is the default on Windows 10/11 and Server 2016+.

How do I use Responder with ntlmrelayx?

Disable Responder's SMB server by setting smb = off in Responder.conf, then start ntlmrelayx.py. Responder captures the NTLM challenge and ntlmrelayx relays it to target systems for authentication without cracking passwords.

Can Responder poison DNS on IPv6 networks?

Yes, Responder supports IPv6 poisoning through router advertisement spoofing and NDP (Neighbor Discovery Protocol) attacks. Use -6 flag to enable IPv6 poisoning for intercepting traffic on IPv6 networks.

How do I extract captured hashes from Responder logs?

Captured hashes are stored in /usr/share/responder/logs/. Parse the files: Responder-Session.log for all activity, SMBv2-NTLMv2-*.txt for NTLMv2 hashes, and HTTP-NTLMv2-*.txt for HTTP captures.

Can Responder capture Kerberos TGT hashes?

Responder focuses on LLMNR/NBT-NS/MDNS name resolution poisoning and NTLM hash capture. For Kerberos attacks, use tools like Rubeus (Windows) or GetUserSPNs.py from Impacket for Kerberoasting.

How do I crack NTLMv2 hashes captured by Responder?

Use Hashcat mode 5600: hashcat -m 5600 hashes.txt wordlist.txt. NTLMv2 hashes are salted with the target's username and domain, making them slower to crack than NTLMv1 but still vulnerable to dictionary attacks.

Does Responder work on wireless networks?

Yes, Responder works on WiFi networks as long as you're on the same network segment as the target. ARP and LLMNR poisoning work at Layer 2, so the attacker must have network access (wired or wireless) to the target segment.

How do I update Responder to the latest version?

Update with: cd /opt/Responder && git pull. Or reinstall from GitHub: git clone https://github.com/lgandx/Responder.git /opt/Responder. Check the version in the banner output.

Tags

#sniffing-spoofing

Output Explanation

Prints intercepted authentication attempts, detailing the target's username, domain context, and the full cryptographic string. This data is also archived in the tool's log directory.

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.