WAD · Tool
Responder is an LLMNR, NBT-NS, and MDNS poisoner. It will answer to specific NBT-NS (NetBIOS Name Service) queries based on their name suffix. By default, the tool will only answer to File Server Service request, which is for SMB. The following command will put Responder in analyze mode, listening for NBT-NS, BROWSER, and LLMNR requests without responding. Command Reference: Interface: eth0
Responder is an LLMNR, NBT-NS, and mDNS poisoner. Run without the analyze flag, it actively answers name-resolution broadcasts (LLMNR, NBT-NS, mDNS) with the attacker's IP, causing victims to connect to Responder's rogue SMB/HTTP/etc. servers and disclose NTLMv1/NTLMv2 challenge-response hashes, which are captured to logs for offline cracking. The -w flag starts the rogue WPAD proxy to poison web-proxy autodiscovery, and -d answers DHCP requests. Captured hashes can be cracked with hashcat or, instead of cracking, forwarded live to ntlmrelayx.py (disable Responder's SMB and HTTP servers in Responder.conf when relaying). This is a noisy, active on-network attack. Command Reference: Interface: eth0 Captured hashes log: hashes.txt