DAdanjoc·Jul 22, 2017Submission
Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in rogue auth server
2 points · Open discussionSpiderLabs
Responder
Python2016–2017
SpiderLabs / Responder · Archived
Responder
Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication.
5Distinct people
5Mentions
0Explicit recommenders
4.9KGitHub stars
What to know before exploring
What it is
Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication.
GitHub
Where it is used
No documented product use has been verified yet.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by month5 dated mentions
Observed mentions: 2016-04-12 20:22:29 UTC to 2017-07-22 18:28:29 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| Apr 2016 | 2016-04-01 00:00:00 UTC | 2016-05-01 00:00:00 UTC | 1 | 0 | 1 |
| May 2016 | 2016-05-01 00:00:00 UTC | 2016-06-01 00:00:00 UTC | 0 | 0 | 0 |
| Jun 2016 | 2016-06-01 00:00:00 UTC | 2016-07-01 00:00:00 UTC | 0 | 0 | 0 |
| Jul 2016 | 2016-07-01 00:00:00 UTC | 2016-08-01 00:00:00 UTC | 0 | 0 | 0 |
| Aug 2016 | 2016-08-01 00:00:00 UTC | 2016-09-01 00:00:00 UTC | 1 | 0 | 1 |
| Sep 2016 | 2016-09-01 00:00:00 UTC | 2016-10-01 00:00:00 UTC | 1 | 0 | 1 |
| Oct 2016 | 2016-10-01 00:00:00 UTC | 2016-11-01 00:00:00 UTC | 0 | 0 | 0 |
| Nov 2016 | 2016-11-01 00:00:00 UTC | 2016-12-01 00:00:00 UTC | 0 | 0 | 0 |
| Dec 2016 | 2016-12-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 0 | 0 | 0 |
| Jan 2017 | 2017-01-01 00:00:00 UTC | 2017-02-01 00:00:00 UTC | 0 | 0 | 0 |
| Feb 2017 | 2017-02-01 00:00:00 UTC | 2017-03-01 00:00:00 UTC | 0 | 0 | 0 |
| Mar 2017 | 2017-03-01 00:00:00 UTC | 2017-04-01 00:00:00 UTC | 0 | 0 | 0 |
| Apr 2017 | 2017-04-01 00:00:00 UTC | 2017-05-01 00:00:00 UTC | 0 | 0 | 0 |
| May 2017 | 2017-05-01 00:00:00 UTC | 2017-06-01 00:00:00 UTC | 0 | 0 | 0 |
| Jun 2017 | 2017-06-01 00:00:00 UTC | 2017-07-01 00:00:00 UTC | 0 | 0 | 0 |
| Jul 2017 | 2017-07-01 00:00:00 UTC | 2017-08-01 00:00:00 UTC | 2 | 1 | 1 |
What Hacker News says
5 sourcesI'll add to that - It is still very easy to hijack SMB connections and use it steal the NTLM hash in almost any network with Windows machines (Managed with a DC or not). Just go ahead and try [1] (Disclaimer - running responder.py without authorization might be considered as a crime and I do not take any responsibility for it. I encourage you to use it only if you understand what you are doing and you have full permission to do it).
[1] https://github.com/SpiderLabs/Responder
In NTLM Hash Leaks: Ancient Microsoft Design FlawCheck out https://github.com/Spiderlabs/Responder for some additional info and links.
In Snagging creds from locked Windows/OS X machines using USB-Armory/Hak5-TurtleIf you're interested in what pentesters (and presumably their bad guy equivalents) are doing these days on internal pen tests where they start from Local LAN access it's a good idea to look at tools like responder(https://github.com/SpiderLabs/Responder), which spoof responses to various queries and can then be used to grab hashes to either to Pass-the-hash attacks or get passed to password cracking tools for recovery of passwords.
There's also tools like bettercap (https://www.bettercap.org/docs/) which can already use various tricks to grab creds once a MiTM is sorted..
In Badlock vulnerability disclosed