In plain-text-happy Windows networks, Responder poisons name resolution and collects password hashes out of thin air. Watching it work rewrites how you think about 'secure by default'.
Follow the steps — click any step card to replay the terminal demo from that point. Everything runs in a lab you control.
Poisoning answers for Windows name resolution.
Someone typos \\printr instead of \\printer — hash captured.
Saved to /usr/share/responder/logs ready for cracking.
5600 = NetNTLMv2; weak passwords fall fast.
Attack → detection → hardening → verify. Full purple loop.
| -I iface | interface |
| -r/-d/-w | poison LLMNR/NBT/ WPAD |
| logs/ | captured hashes |
| -m 5600 | hashcat NetNTLMv2 mode |
| ntlmrelayx | next-stage relaying |
Every hash you capture is a failed policy: LLMNR/NBT-NS must die in every domain.
Relay captured auth with ntlmrelayx (Impacket) — the advanced follow-on.
SOC lens: Responder traffic patterns are highly detectable. Write the Sigma rule.
On authorized engagements only — this one is plasma-hot in real networks.
Use Responder only on systems you own or have written permission to test. Your lab: Kali + Metasploitable2, DVWA, TryHackMe & HackTheBox — plenty of legal targets, zero risk.