Responder
A network poisoning tool that captures authentication credentials by spoofing LLMNR, NBT-NS, and mDNS responses.
What is Responder?
Responder is a network poisoning tool that intercepts LLMNR, NBT-NS, and mDNS queries to capture authentication credentials. It works by spoofing responses to redirect clients to rogue servers, allowing security professionals to harvest NTLM hashes and clear-text passwords during penetration tests.
Penetration testers, red teamers, and network security researchers who need to assess credential exposure and network vulnerabilities in Windows and mixed environments.
Responder provides a comprehensive, all-in-one solution for credential capture across multiple protocols, with built-in stealth features to avoid disrupting legitimate network services while effectively harvesting authentication data.
Overview
Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication.
Use Cases
Best For
- Capturing NTLM hashes during internal network penetration tests
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
