Responder
LLMNR/NBT-NS/MDNS poisoner & credential capture.
KaliParrothigh
pkg: responder
Responder answers LLMNR/NBT-NS/mDNS queries to capture NTLM hashes and credentials on Windows networks.
Syntax
responder -I {iface} [-wv]
Example
sudo responder -I eth0 -wv
Poisons name-resolution requests on eth0 and logs captured NTLM hashes.
Options & flags
What each switch does. Toggle them in the builder below to assemble a command.
Command builder
Tick options (and fill any values) to build a ready-to-copy command.
responder
Usage examples
responder -I eth0 -wv
Poison name resolution and capture hashes.
responder -I eth0 -A
Passive analysis without poisoning.
Advantages
- Devastating on default Windows nets
- Captures NTLM for offline cracking/relay
- Simple to run
Disadvantages
- Extremely loud / clearly malicious
- Network-disruptive
- Authorization essential
Tags
#ntlm#windows#poisoning
Official docs: Responder ↗
Related commands
Frequently asked questions
What is Responder used for?
Responder answers LLMNR/NBT-NS/mDNS queries to capture NTLM hashes and credentials on Windows networks.
What is an example Responder command?
A common example is: sudo responder -I eth0 -wv — Poisons name-resolution requests on eth0 and logs captured NTLM hashes.
Is Responder part of Kali Linux?
Yes. Responder ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install responder.
What category of security tool is Responder?
Responder is a Sniffing & Spoofing tool with a high-risk profile when run against a live target.
Try recon tools live
Run real scans against a domain you control, stage by stage.