Responder

Responder poisons LLMNR, NBT-NS, and mDNS queries, answering specific NBT-NS requests based on name suffixes to target File Server Service (SMB) by default. It launches rogue servers for protocols like HTTP, HTTPS, SMB, SQL, FTP, and others to capture authentication attempts including NTLM hashes. The tool is designed to be stealthy by selectively responding to avoid disrupting legitimate network behavior.

Use cases include capturing Net-NTLMv2 hashes on Windows networks during penetration tests, WPAD proxy attacks to force authentication, and DHCP injection for proxy discovery. It supports analysis mode for passive monitoring and various downgrades like LM hashing or disabling ESS for compatibility with older systems.

Responder includes additional utilities like MultiRelay for relay attacks, ICMP redirect for traffic manipulation, and fingerprinting modules. It's particularly effective on networks with misconfigured name resolution where clients fall back to broadcast queries.

Responder listens for LLMNR (port 5355 UDP), NBT-NS (port 137 UDP), and mDNS queries, poisoning responses to redirect clients to attacker-controlled rogue servers. For NBT-NS, it targets specific service suffixes like File Server (0x20) for SMB or optionally Workstation Service (-r). WPAD attacks serve malicious proxy.pac files via HTTP/HTTPS. Authentication servers emulate SMB, SQL, FTP, etc., capturing NTLMv1/v2 challenges or Basic auth. DHCP/DHCPv6 options inject WPAD or DNS servers. External IP poisoning (-e/-6) and Router Advertisements (--rdnss) enable remote redirection.