Responder
Responder is a name resolution poisoning tool that captures credentials by answering broadcast name resolution requests on a local network. It exploits the fallback behavior of Windows name resolution to intercept authentication and collect NTLMv2 hashes.
Strategic context
Windows systems resolve hostnames through a sequence of methods: DNS first, then NetBIOS Name Service (NBT-NS), then Link-Local Multicast Name Resolution (LLMNR). When DNS resolution fails, because a hostname is misspelled, a server has been decommissioned, or a mapped drive points to a system that no longer exists, the requesting system broadcasts an LLMNR or NBT-NS query to the local network asking if anyone can resolve the name.
Responder answers these broadcast queries, claiming to be the requested host. The requesting system then attempts to authenticate to Responder, sending its NTLMv2 hash in the process. This hash can be cracked offline or relayed to other services for immediate access.
The technique is effective because broadcast name resolution failures are common in enterprise environments. Stale GPO mappings, decommissioned servers, misconfigured applications, and user typos all generate failed DNS lookups that fall back to broadcast resolution. Responder passively collects these authentication attempts without requiring any interaction with the target users.
For security leaders, Responder exploitation shows a fundamental weakness in default Windows name resolution behavior. Disabling LLMNR and NBT-NS across the environment eliminates the attack vector entirely. Where disabling these protocols isn't feasible, SMB signing enforcement prevents the relayed authentication that converts captured hashes into immediate access. Monitor for LLMNR and NBT-NS traffic from unexpected sources.
Execution examples
Basic credential capture
Running Responder on the appropriate network interface begins poisoning broadcast name resolution requests:
responder -I eth0 -dwvThe flags serve specific purposes: -d enables DHCP responses, -w starts the WPAD proxy server, and -v enables verbose output. When a system on the local network makes a broadcast name resolution request, Responder answers it and captures the resulting NTLMv2 hash.
Captured hashes appear in the console output and are saved to log files in the Responder logs directory, formatted for direct use with hash cracking tools.
Cracking captured hashes
NTLMv2 hashes captured by Responder can be cracked offline using Hashcat or John the Ripper:
# Hashcat
hashcat -m 5600 captured_hashes.txt wordlist.txt -r rules/best64.rule
# John the Ripper
john --wordlist=wordlist.txt captured_hashes.txtHashcat mode 5600 corresponds to NTLMv2 hashes. The rule file applies transformations to the wordlist to increase coverage.
Relay attacks with NTLMRelayX
Instead of cracking captured hashes, Responder can be paired with Impacket's NTLMRelayX to relay authentication directly to other services. When relaying, Responder's SMB and HTTP servers must be disabled to avoid conflicts:
The targets file contains systems where SMB signing is not required. When a user's authentication is captured by Responder, NTLMRelayX forwards it to a target system, gaining access as that user without ever knowing or cracking their password.
Relaying to LDAP on a domain controller enables more impactful actions:
This can modify Active Directory objects, including granting the attacker's account DCSync rights for full domain credential extraction.
Targeted poisoning with WPAD
Responder's WPAD server responds to Web Proxy Auto-Discovery requests, which systems issue when configured to auto-detect proxy settings:
The -F flag forces NTLM authentication for the WPAD file request. This is especially effective because WPAD requests are generated by default browser behavior on many Windows configurations.
Where Responder fits in the lifecycle
Initial access: Capturing and cracking credentials from a position on the internal network provides authenticated access without exploiting a vulnerability
Privilege escalation: Captured hashes may belong to privileged accounts; relaying to domain controllers can grant DCSync rights
Lateral movement: Cracked passwords or relayed authentication provides access to additional systems
Last updated