Responder

LLMNR/NBT-NS/MDNS poisoner & credential capture.

KaliParrothigh

pkg: responder

Responder answers LLMNR/NBT-NS/mDNS queries to capture NTLM hashes and credentials on Windows networks.

Syntax

responder -I {iface} [-wv]

Example

sudo responder -I eth0 -wv

Poisons name-resolution requests on eth0 and logs captured NTLM hashes.

Options & flags

What each switch does. Toggle them in the builder below to assemble a command.

-I <eth0>Interface to listen on.
-wStart the WPAD rogue proxy.
-vVerbose.
-AAnalyze mode (passive — no poisoning).
-FForce WPAD auth.

Command builder

Tick options (and fill any values) to build a ready-to-copy command.

responder

Usage examples

responder -I eth0 -wv

Poison name resolution and capture hashes.

responder -I eth0 -A

Passive analysis without poisoning.

Advantages
  • Devastating on default Windows nets
  • Captures NTLM for offline cracking/relay
  • Simple to run
Disadvantages
  • Extremely loud / clearly malicious
  • Network-disruptive
  • Authorization essential
Tags
#ntlm#windows#poisoning

Official docs: Responder

Related commands

Frequently asked questions

What is Responder used for?
Responder answers LLMNR/NBT-NS/mDNS queries to capture NTLM hashes and credentials on Windows networks.
What is an example Responder command?
A common example is: sudo responder -I eth0 -wv — Poisons name-resolution requests on eth0 and logs captured NTLM hashes.
Is Responder part of Kali Linux?
Yes. Responder ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install responder.
What category of security tool is Responder?
Responder is a Sniffing & Spoofing tool with a high-risk profile when run against a live target.

Try recon tools live

Run real scans against a domain you control, stage by stage.

Open the lab →