Responder
LLMNR, NBT-NS, and mDNS poisoner that captures network credentials and runs rogue authentication servers during authorized internal assessments.
Technical Architecture & Overview
Responder is a Python tool that listens for LLMNR, NBT-NS, and mDNS name-resolution queries from Windows hosts. It can return spoofed responses and run rogue authentication servers for SMB, HTTP, LDAP, and other protocols to demonstrate credential exposure. Network administrators use it to identify where name-resolution fallback protocols are enabled and unneeded.
Targeted Technical Use Cases
Use Responder to test whether LLMNR, NBT-NS, and mDNS are enabled on an internal network and to validate network segmentation controls.
Evaluation & Trade-offs
Core Strengths
- +Identifies name-resolution fallback protocols that can leak hashes on a local network.
- +Includes many protocol servers in one tool, including SMB, HTTP, LDAP, and Kerberos.
- +Runs on Linux and macOS with a simple command-line interface.
Trade-Offs & Limitations
- -May require administrative privileges and raw socket access on the host.
- -Can disrupt legitimate name-resolution traffic if used without scoping.
Defensive Security Application
Use Responder during internal audits to locate and disable LLMNR, NBT-NS, and mDNS, then enforce DNS server assignment and network segmentation.
Frequently Asked Questions
What is Responder?→
Responder is a Python tool that listens for LLMNR, NBT-NS, and mDNS name-resolution queries from Windows hosts. It can return spoofed responses and run rogue authentication servers for SMB, HTTP, LDAP, and other protocols to demonstrate credential exposure. Network administrators use it to identify where name-resolution fallback protocols are enabled and unneeded.
What is Responder used for?→
Use Responder to test whether LLMNR, NBT-NS, and mDNS are enabled on an internal network and to validate network segmentation controls.
What are the strengths of Responder?→
- +Identifies name-resolution fallback protocols that can leak hashes on a local network.
- +Includes many protocol servers in one tool, including SMB, HTTP, LDAP, and Kerberos.
- +Runs on Linux and macOS with a simple command-line interface.
What are the limitations of Responder?→
- +May require administrative privileges and raw socket access on the host.
- +Can disrupt legitimate name-resolution traffic if used without scoping.
How is Responder used defensively?→
Use Responder during internal audits to locate and disable LLMNR, NBT-NS, and mDNS, then enforce DNS server assignment and network segmentation.