Responder

Responder

Purpose

Use this skill only when the rules of engagement explicitly permit testing legacy name-resolution weaknesses.

Phase Fit

• Primary: Vulnerability Analysis, Validation and Controlled Impact Demonstration
• Secondary: Detection and Response Assessment

Use When

• Need to determine whether LLMNR, NBT-NS, or mDNS creates a credential capture path.
• Need to validate whether the environment still relies on weak name resolution.
• Need to measure whether defenders can see and respond to the activity.

Avoid When

• Name-resolution testing is not explicitly approved.
• The environment is highly sensitive or could be disrupted by active poisoning behavior.

Inputs

• Approved interface and segment
• Explicit approval for analyze-only or active behavior
• Evidence handling rules for captured authentication material

Procedure

1. Default to analyze-only behavior unless active testing is explicitly approved.
2. Limit testing to the approved segment and time window.
3. Capture only the evidence needed to prove the weakness.
4. Coordinate with defenders if detection validation is in scope.
5. Stop immediately if the activity exceeds the approved impact level.

Command Syntax

Replace sample interfaces with the approved capture segment. Prefer analyze mode first.

# Analyze mode only — no poisoning, safe observation
responder -I eth0 -A

# Analyze mode with verbose output
responder -I eth0 -A -v

# Active poisoning (requires explicit approval)
responder -I eth0

# Disable HTTP and SMB servers, LLMNR/NBT-NS only
responder -I eth0 -d -F

# Enable WPAD attack
responder -I eth0 --wpad

# Review captured hashes from Responder logs
cat Responder-Session.log
ls logs/

Evidence to Capture

• Whether legacy name resolution is active on the segment
• Credential-risk observations tied to the tested path
• Detection or logging gaps if defenders are in scope

Safety Boundaries

• Use active poisoning behavior only with explicit written approval.
• Protect any captured material as sensitive evidence.