E-RES
responder
LLMNR/NBT-NS/mDNS poisoner that captures NTLM authentication attempts broadcast on a local network segment.
OVERVIEW
Responder (lgandx/Responder) listens on a network segment and answers LLMNR, NBT-NS, and mDNS name-resolution broadcasts — the fallback lookups Windows sends when DNS doesn't have an answer — by claiming to be whatever host was being asked for. Any client that then tries to authenticate to that (fake) host sends its NTLM challenge-response to Responder's built-in rogue SMB, HTTP, MSSQL, FTP, and LDAP servers, which log it for offline cracking or relay.
It requires no exploit and no prior foothold beyond network access: on most unhardened Windows networks, simply running it for a while on the internal segment yields a steady trickle of captured hashes, which is exactly why it's a standard technique taught in AD-focused pentesting courses (including SANS and OSCP-style curricula) and why disabling LLMNR/NBT-NS via Group Policy is one of the most common findings it's used to substantiate.
USE CASES
Practical use cases
- 01
Capturing NTLM challenge-responses from misconfigured name resolution to crack offline with hashcat.
- 02
Demonstrating, with client authorization, that LLMNR/NBT-NS is enabled and actively leaking credential material.
- 03
Feeding captured hashes into an NTLM relay chain (e.g. via ntlmrelayx) against hosts with SMB signing disabled.
- 04
Validating that a prior LLMNR/NBT-NS remediation (GPO change) actually stopped broadcast poisoning from working.
QUICK START
Placed on an internal network segment with explicit authorization, to demonstrate that LLMNR/NBT-NS name-resolution broadcasts leak crackable NTLM authentication.
- Get explicit written authorization to run a broadcast poisoner on this specific network segment — it affects every host on the segment, not just a designated target.
- Install Responder (git clone + Python 3) on a box with a foothold on the internal segment.
- Run it against the correct interface, with the SMB/HTTP servers left on for auth capture, off if only relaying downstream.
- Let it run for an agreed window and monitor the log for captured NetNTLMv2 hashes.
- Crack captured hashes offline (hashcat) and report LLMNR/NBT-NS exposure alongside the recommended GPO fix.
sudo python3 Responder.py -I eth0 -wrfBEFORE YOU RUN IT
What to check before running it
Only run this with explicit written authorization scoped to the network segment, not just a target host: it answers broadcasts from every machine on that segment, so it can capture credentials from systems and users never named in the engagement.
The standard mitigation is disabling LLMNR and NBT-NS via Group Policy (and securing mDNS separately) — report that as the finding rather than treating a successful capture as the deliverable on its own.
Leaving the rogue SMB/HTTP servers on can interfere with legitimate name resolution and break unrelated services during the capture window; agree on timing and rollback with the client beforehand.