Identity
Responder
LLMNR/NBT-NS/mDNS analysis and poisoning for authorized internal identity assessments.
What it is
Responder listens for name-resolution broadcasts and, when the RoE allows, answers them to capture hashes or demonstrate relay preconditions. Prefer analyze mode first. Poisoning is an active technique — treat it as exploitation, not recon.
Reach for it when
Internal assumed-breach when you need to show name-resolution hygiene issues on user VLANs, with an explicit RoE line.
Watch-outs
Poisoning production will disrupt printing, file shares, and sometimes auth. Start in analyze (-A). Never poison DC or OT VLANs. Do not crack captured hashes on a laptop; vault only. Coordinate with blue team so they do not treat you as an incident.
Typical invocation
responder -I eth0 -A
Authorized assessments only. Stay inside the rules of engagement.
Pin to a kit
Open an engagement first.
Related
- Wireshark
Packet capture and protocol analysis for authorized network and wireless assessments.
- hashcat
GPU password recovery against hashes obtained under RoE, run only in the engagement vault.
- NetExec
Network execution and enumeration suite for SMB, LDAP, WinRM, and related Windows services.
- Impacket
Python collection of Windows/AD protocol tools for authorized authentication and post-ex proof.