SpiderLabs/ResponderArchived
Responder
Responder is a man-in-the-middle framework and network protocol spoofing tool designed to intercept network name queries and impersonate requested resources. It functions as a poisoner for LLMNR, NBT-NS, and MDNS, redirecting network traffic from clients to a controlled listener.
The project serves as a credential capture tool that runs rogue servers for SMB, HTTP, and LDAP to collect NTLM hashes and clear text credentials. It enables the harvesting of encrypted authentication tokens and the interception of usernames and passwords sent without encryption.
Its broader capabilities include internal network reconnaissance and local network penetration testing. The tool supports network traffic manipulation through spoofed DNS and DHCP responses, as well as the ability to map active hosts and fingerprint workstations by analyzing network traffic.
Features
- Rogue Multi-Protocol Servers - Runs concurrent rogue servers for SMB, HTTP, and LDAP to capture authentication credentials.
- LLMNR/NBT-NS/mDNS Poisoners - Provides a system for poisoning LLMNR, NBT-NS, and mDNS queries to redirect traffic and capture NTLM hashes.
- DHCP Poisoners - Injects rogue DNS servers or WPAD proxy settings into DHCP responses to redirect traffic.
- DNS Query Poisoners - Redirects network traffic by providing malicious responses to name resolution queries.
- Infrastructure Service Spoofing - Intercepts and answers network queries by crafting raw packets that impersonate legitimate infrastructure services.
- Authentication Hash Capture - Intercepts and logs network authentication hashes from connecting clients for offline cracking.
- MITM Credential Harvesters - Intercepts and logs NTLM authentication hashes in real-time via man-in-the-middle attacks.
- DNS Spoofing Tools - Intercepts and modifies DNS query responses to redirect network traffic.
- Protocol Spoofing Tools - Sends fraudulent DHCP and DNS responses to manipulate client network configurations and redirect traffic.
- Traffic Redirection Rules - Uses DNS overrides and spoofing rules to redirect client traffic toward a controlled listener.
- Network Credential Capturers - Extracts NTLM hashes and cleartext passwords from intercepted network authentication handshakes.
- Man-in-the-Middle Frameworks - Implements a comprehensive framework for intercepting and manipulating network traffic between endpoints to capture authentication data.
- Multi-Protocol Identity Simulation - Simulates multiple network identities simultaneously to intercept diverse types of client-server requests.
- Credential Capture Tools - Runs rogue SMB, HTTP, and LDAP servers to harvest NTLM hashes and clear text credentials.
- Internal Network Penetration Testers - Identifies vulnerabilities and weak authentication protocols within an internal network via resource impersonation.
- WPAD Proxy Impersonation - Impersonates a proxy server to capture incoming requests by delivering custom WPAD scripts.
- Asynchronous Packet Listeners - Implements non-blocking background listeners to capture network packets for identifying targets and mapping workstations.
- Host Infrastructure Fingerprinting - Profiles active network hosts by analyzing the specific types of queries they issue.
- Passive Network Reconnaissance - Discovers hosts and services on a LAN by passively sniffing network traffic.
- Passive Traffic Analyzers - Passively monitors LLMNR, NBT-NS, and mDNS traffic to map network domains and workstations.
- Credential Interception - Captures usernames and passwords sent in clear text by running rogue email and file transfer servers.
- Tools - Listed in the “Tools” section of the Awesome Scapy awesome list.
- Active Directory Exploitation - Tool for LLMNR, NBT-NS, and MDNS poisoning to capture credentials.
- Network Attacks - Tool for LLMNR, NBT-NS, and MDNS poisoning.
- Network Exploitation and Tunneling - Poisoning tool for LLMNR and NBT-NS protocols to capture credentials.
- Network Security Analysis - Poisons network traffic to conduct man-in-the-middle attacks.
- Windows Security Utilities - Poisoning tool for network name resolution protocols.
Star history
How this analysis was created: This summary and feature list were written by an AI model that read the project's README and public documentation pages. Each feature links to the documentation it came from; stars, license and language come straight from the GitHub API. The model does not read the source code, and the analysis is refreshed when the project is re-analysed. Learn more on our About page.
