Responder
LLMNR, NBT-NS, and mDNS poisoner that captures network credentials and runs rogue authentication servers during authorized internal assessments.
Technical Architecture & Overview
Responder is a Python tool that listens for LLMNR, NBT-NS, and mDNS name-resolution queries on the local network. It can return spoofed responses and run rogue authentication servers for SMB, HTTP, LDAP, and other protocols to demonstrate credential exposure. Its analyze mode shows these requests without responding, which identifies where name-resolution fallback protocols are enabled.
Targeted Technical Use Cases
Use Responder to test whether LLMNR, NBT-NS, and mDNS are enabled on an internal network.
Evaluation & Trade-offs
Core Strengths
- +Identifies name-resolution fallback protocols that can leak hashes on a local network.
- +Includes many protocol servers in one tool, including SMB, HTTP, LDAP, and Kerberos.
- +Runs on Linux and macOS with a simple command-line interface.
Trade-Offs & Limitations
- -Requires root privileges on the host.
- -Answers requests from all hosts by default; the RespondTo settings in Responder.conf limit it to in-scope addresses and names.
Defensive Security Application
Use Responder during internal audits to locate and disable LLMNR, NBT-NS, and mDNS, then enable DHCP snooping and IPv6 RA and DHCPv6 guards.
Frequently Asked Questions
What is Responder?→
Responder is a Python tool that listens for LLMNR, NBT-NS, and mDNS name-resolution queries on the local network. It can return spoofed responses and run rogue authentication servers for SMB, HTTP, LDAP, and other protocols to demonstrate credential exposure. Its analyze mode shows these requests without responding, which identifies where name-resolution fallback protocols are enabled.
What is Responder used for?→
Use Responder to test whether LLMNR, NBT-NS, and mDNS are enabled on an internal network.
What are the strengths of Responder?→
- +Identifies name-resolution fallback protocols that can leak hashes on a local network.
- +Includes many protocol servers in one tool, including SMB, HTTP, LDAP, and Kerberos.
- +Runs on Linux and macOS with a simple command-line interface.
What are the limitations of Responder?→
- +Requires root privileges on the host.
- +Answers requests from all hosts by default; the RespondTo settings in Responder.conf limit it to in-scope addresses and names.
How is Responder used defensively?→
Use Responder during internal audits to locate and disable LLMNR, NBT-NS, and mDNS, then enable DHCP snooping and IPv6 RA and DHCPv6 guards.