Responder

Network poisoner that captures NTLMv2 hashes by answering broadcast name resolution requests. A passive attack, you just run it and wait for credentials to come to you.

AD CPTS Python Linux (attacker)

LevelBeginner. A passive attack: run it and wait, no target enumeration needed first.

Know firstWhat LLMNR, NBT-NS and mDNS are (broadcast name resolution that Windows falls back to when DNS fails), and what an NTLMv2 hash looks like.

You will learn tostart Responder on the right interface, understand why hashes show up, and know when to crack versus relay.

What is it?

When a Windows machine tries to access a resource by hostname and DNS doesn't know the answer, the machine falls back to broadcast protocols to ask everyone on the local network: "Hey, does anyone know where \\fileserv is?" These protocols are:

LLMNR (Link-Local Multicast Name Resolution): multicast on port 5355
NBT-NS (NetBIOS Name Service): broadcast on port 137
mDNS (Multicast DNS): multicast on port 5353

Responder answers these broadcasts and says: "That's me!" The victim machine then tries to authenticate to Responder, sending its NTLMv2 hash in the process. You capture that hash and crack it offline with Hashcat.

This happens because of a design flaw in Windows name resolution: it trusts whoever answers first, with no verification. It's like shouting "Anyone know Mike's phone number?" in a crowded room, anyone can answer, and you'll trust the first response.

Why it works so often

Typos in network paths: a user types \\fileserv instead of \\fileserver: DNS fails, broadcast kicks in
Stale drive mappings: a mapped drive to a server that no longer exists
WPAD (Web Proxy Auto Discovery): machines look for wpad.domain.local at boot: if DNS doesn't have it, broadcast
Printers, backup software, monitoring agents, all making periodic connections by hostname

Run this first

Responder listens for the broadcast name lookups Windows makes when DNS fails, and answers them itself.

bash: your first listener

$ sudo responder -I eth0

sudo is required: Responder binds to privileged ports 53, 80 and 445.
-I eth0 is your network interface. On an HTB VPN this is usually tun0, not eth0.

Leave it running. NTLMv2 hashes appear as machines on the network look up names that do not exist, which can take anywhere from a few minutes to half an hour. Crack what you capture with hashcat mode 5600, or relay it directly with ntlmrelayx instead of cracking.

What does it do?

Responder runs multiple fake servers simultaneously:

Fake service	What it captures
SMB server	NTLMv2 hashes from file share access attempts
HTTP server	NTLMv2 hashes from web requests (WPAD, proxy config)
FTP server	Cleartext credentials
LDAP server	Cleartext or NTLM credentials
SQL server	Cleartext credentials
WPAD proxy	NTLMv2 hashes from proxy auto-discovery

The captured NTLMv2 hashes are saved to log files and also printed to screen. These are not the same as NT hashes you can pass-the-hash with, they need to be cracked first. But NTLMv2 hashes crack fast with a good wordlist.

When do you use it?

At the very start of an internal pentest, before you have any credentials. Responder is one of the first tools to run when you're on a network with no creds. It's passive, you're not attacking anything, just listening and answering questions.

Two main scenarios:

No creds yet: Run Responder, wait 5-30 minutes, collect NTLMv2 hashes, crack them → first domain user
Combined with ntlmrelayx: Instead of capturing and cracking, relay the authentication directly to another server for instant code execution (see ntlmrelayx)

HTB/CPTS context

In HTB labs, Responder often captures hashes within seconds because the lab simulates user activity. In the CPTS exam, you might need to wait longer. Start Responder early and let it run in the background while you enumerate other things.

How do you spot it?

When to run Responder

You're on the internal network (VPN or physical) and have no domain credentials yet
Multiple Windows hosts are on the same subnet: more hosts = more broadcast traffic = more hashes
You need a quick win: Responder is the lowest-effort way to get initial creds
You suspect WPAD is in use: especially if you see proxy settings in browser configs

When NOT to use Responder

You already have domain creds: Responder is mainly for initial access. Use your time on BloodHound/certipy instead
Stealth is critical: Responder's poisoning is detectable by security monitoring
You're on an isolated VLAN with no other hosts: nobody to answer, nobody to capture from

How do you use it?

Basic capture mode

bash

# Start Responder on your network interface
$ sudo responder -I eth0

[+] Listening for events...
[*] [NBT-NS] Poisoned answer sent to 10.10.10.50 for name FILESERV  <-- a host looked up a name that doesn't exist, and Responder answered
[SMB] NTLMv2-SSP Client   : 10.10.10.50
[SMB] NTLMv2-SSP Username : CORP\j.smith
[SMB] NTLMv2-SSP Hash     : j.smith::CORP:1122334455667788:AABBCCDD...  <-- crack this with hashcat mode 5600, or relay it live instead

With analysis mode (passive, no poisoning)

bash

# Just listen and log, no poisoning (safe recon)
$ sudo responder -I eth0 -A

For use with ntlmrelayx (disable SMB + HTTP servers)

bash

# When relaying, Responder should NOT serve SMB/HTTP
# Edit /etc/responder/Responder.conf first:
#   SMB = Off
#   HTTP = Off

# Then run Responder (it still poisons, just doesn't serve)
$ sudo responder -I eth0

# In another terminal, run ntlmrelayx
$ impacket-ntlmrelayx -tf targets.txt -smb2support

Cracking captured hashes

bash

# Responder saves hashes to /usr/share/responder/logs/ (or /opt/Responder/logs/)
$ ls /usr/share/responder/logs/
SMB-NTLMv2-SSP-10.10.10.50.txt
HTTP-NTLMv2-10.10.10.51.txt

# Crack with hashcat (mode 5600 = NTLMv2)
$ hashcat -m 5600 /usr/share/responder/logs/SMB-NTLMv2-SSP-10.10.10.50.txt /usr/share/wordlists/rockyou.txt

j.smith::CORP:...:Spring2024!  <-- the cracked password, try it everywhere

Session..........: hashcat
Status...........: Cracked

What do you do with the output?

Cracked password? → You now have domain creds. Immediately run BloodHound, certipy find, and enumerate the domain
Can't crack the hash? → Try relaying instead (see ntlmrelayx). You don't need to crack if you can relay
Multiple hashes from different users? → Try all of them. One might have a weak password
Hash from a machine account ($)? → Machine account hashes are auto-generated and nearly impossible to crack. Skip these
Keep Responder running in the background: more hashes come in over time as users log in and scripts run

Common mistakes

Things that go wrong

Wrong interface: -I eth0 must match your actual interface. Check with ip a. On HTB VPN it's usually tun0
Forgetting sudo: Responder needs root to bind to privileged ports (53, 80, 445)
Not disabling SMB/HTTP when relaying: If ntlmrelayx and Responder both try to serve SMB, one fails. Edit Responder.conf to disable SMB + HTTP when relaying
Trying to pass-the-hash with NTLMv2: NTLMv2 hashes ≠ NT hashes. You MUST crack NTLMv2 first. Only NT hashes (from secretsdump/mimikatz) work for PtH
Impatience: On real networks, it can take 10-30 minutes for the first hash. Let it run in the background
Using -w (WPAD) on HTB: The -w flag enables WPAD poisoning, which can be very effective but also very noisy. On HTB labs it's usually fine; on real engagements, check the rules of engagement first

NTLMv2 vs NT hash: know the difference

NTLMv2 hash (from Responder): user::DOMAIN:challenge:response:blob: this is a challenge-response, must be cracked. Hashcat mode 5600.

NT hash (from secretsdump/mimikatz): aad3b435b514:2b576acbe6bc...: this IS the password hash, can be used directly for pass-the-hash. No cracking needed.

Check yourself

Answer each question out loud or on paper first, then open it. Retrieving the answer teaches you more than rereading the page.

You run Responder on eth0 and get nothing after 20 minutes. What do you check first?

That the interface is right. Check with ip a; on an HTB VPN the interface is usually tun0, not eth0.

Why does Responder need root?

It binds to privileged ports 53, 80 and 445.

You captured an NTLMv2 hash. Can you pass it the way you would pass an NT hash?

No. NTLMv2 is not the same as an NT hash. You have to crack it first, with hashcat mode 5600. Only NT hashes, from tools like secretsdump or Mimikatz, work for pass-the-hash.

Running ntlmrelayx and Responder together, SMB fails on one of them. Why, and what do you change?

Both are trying to serve SMB on port 445 at once. Disable SMB and HTTP in Responder.conf when relaying, so ntlmrelayx can use those ports.

A hash comes from a username ending in $. Is it worth cracking?

Usually not. That is a machine account, and its password is a long random value that is essentially never crackable.