Responder
Poisons LLMNR/NBT-NS/mDNS and captures NetNTLMv2 hashes to crack or relay.
LLMNR, NBT-NS and mDNS poisoner. When a Windows host resolves a name the DNS does not know, it asks over multicast; Responder answers impersonating the resource and captures the NetNTLMv2 hash of whoever tries to authenticate, to crack or relay it.
Family NTLM coercion & relay
Flags -I <iface> -wv
Concepts LLMNR / NBT-NS Poisoning, Hash Cracking
Cheatsheet LLMNR / NBT-NS poisoning
Installation
sudo apt install -y responderUseful commands
Appears in
Some machines where its use is documented; not an exhaustive list.
- VaultProving Grounds Practice