LLMNR/NBT-NS/mDNS poisoner and rogue multi-protocol (SMB/HTTP/LDAP/FTP/…) authentication-capture listener. Answers name-resolution broadcast requests as if it were the requested host, then captures whatever NTLM authentication a victim sends when it connects — also works as a bare listener with no poisoning at all, capturing anything pointed at it directly (see Forced NTLM Authentication (SCF, LNK, URL)).
Common Flags
Flag
Description
-I <iface>
Interface to listen/poison on, e.g. tun0.
-w
Start the rogue WPAD proxy server alongside the poisoners.
-A
Analyze-only mode — observe broadcast traffic without answering/poisoning anything.
-f
Attempt to fingerprint hosts that send requests.
Common Commands
Command
Description
sudo responder -I <iface> -w
Start poisoning/listening on the given interface.
Tips & Tricks
Poisoning and forced-authentication delivery (a malicious .scf/.lnk file, a coerced UNC path) are two different ways of getting a victim to authenticate to Responder — the capture mechanism once that authentication arrives is identical either way.
Captured hashes are written under /usr/share/responder/logs/, split by protocol and victim IP — check there if a capture scrolled past in the live terminal output.
Captured NetNTLMv2 values are challenge-responses, not directly reusable hashes — crack them offline with John the Ripper (--format=netntlmv2) or Hashcat (-m 5600).