Responder Poisoning LabStep-by-step reference: demo LLMNR poisoning & credential capture with Responder. Lab only.FAQ

What is Responder?

Responder is a free, open-source network poisoning tool by Laurent Gaffie. It answers LLMNR, NBT-NS, and mDNS queries on a LAN, capturing NetNTLM hashes when Windows hosts authenticate to it, with rogue servers and relay pairing.

Is using Responder legal?

Responder itself is legitimate auditing software. Poisoning networks without explicit written permission is illegal. Run it only in isolated labs or signed engagements where poisoning is explicitly in scope.

How do I install Responder?

It ships with Kali. Elsewhere clone github.com/lgandx/Responder and run sudo python3 Responder.py. Confirm your lab interface with ip a first.

How do I capture hashes?

Run sudo python3 Responder.py -I eth0 -wF on the lab segment. Trigger victim traffic with a bad share path, then crack captures offline with hashcat mode 5600.

What is the difference between capture and relay?

Capture stores hashes for offline cracking. Relay forwards live authentication to ntlmrelayx for immediate access without cracking — disable local SMB/HTTP servers so auth forwards.

Why am I getting no hashes?

Check same-segment position, confirm targets emit LLMNR, and generate traffic deliberately. Hardened or isolated hosts stay silent by design.

How do defenders stop Responder?

Disable LLMNR and NBT-NS via Group Policy, enforce SMB signing and LDAP channel binding, block outbound SMB, and monitor for rogue NBNS/LLMNR answers.

What is Analyze mode?

The -A flag watches name traffic without poisoning anything — safe reconnaissance that maps chatty hosts before an authorized poisoning window.

All tools · Sitemap · Games