Responder Attack.

An attack that uses Laurent Gaffie's Responder tool to poison LLMNR, NBT-NS, and mDNS, run rogue authentication servers, and capture or relay NTLM credentials on a local network. It belongs to the Attacks & Threats category of cybersecurity.

An attack that uses Laurent Gaffie's Responder tool to poison LLMNR, NBT-NS, and mDNS, run rogue authentication servers, and capture or relay NTLM credentials on a local network.

Responder is a Python tool that combines LLMNR, NBT-NS, mDNS, and DHCPv6 poisoning with built-in rogue SMB, HTTP, FTP, MSSQL, LDAP, WPAD, and proxy authentication servers. When a victim mistypes a hostname or has a misconfigured share, Responder answers, prompts the victim to authenticate, and harvests NTLMv1/NTLMv2 challenge-response hashes for offline cracking with hashcat or john. With analyse mode it operates passively, and with the -wf flag it runs a malicious WPAD server. Used jointly with Impacket's ntlmrelayx, it pipes captured authentications into NTLM relay attacks. Defenders disable LLMNR and NBT-NS via GPO, enforce SMB and LDAP signing, deploy Extended Protection for Authentication, and segment networks to deny rogue Layer-2 access.

Defences for Responder Attack typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Responder tool attack, LLMNR/NBT-NS poisoner.