What problem does it solve?
In authorized Windows domain penetration tests, credentials are often needed to move laterally, but actively attacking services is noisy. This Skill explains how to passively capture NTLMv2 authentication hashes by poisoning LLMNR, NBT-NS, and mDNS name resolution broadcasts with Responder, then crack them offline or relay them to other services.
Core Features & Use Cases
- Passive Hash Capture: Run Responder on a network interface to answer name resolution broadcasts and record NTLMv2 hashes to log files.
- Hash Cracking Workflow: Feed captured hashes directly into hashcat (mode 5600 for NTLMv2, 5500 for NTLMv1) for offline password recovery.
- NTLM Relaying: Disable Responder's SMB/HTTP listeners and pair it with ntlmrelayx to relay captured authentication to targets without SMB signing.
- WPAD and DHCPv6 Attacks: Use WPAD proxy poisoning and DHCPv6/mitm6 techniques to capture additional authentication traffic.
- Use Case: During an internal assessment, start Responder in analysis mode to confirm broadcast traffic, then run
responder -I eth0 -wv during business hours to collect hashes from mistyped hostnames and stale shortcuts.
Quick Start
Ask the AI to start Responder on interface eth0 in verbose mode with WPAD enabled and show any captured NTLMv2 hashes from the Responder logs directory.
