Responder is an open source tool used for LLMNR, NBT-NS and MDNS poisoning, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication.
| Technique | Procedure example |
|---|---|
| T1040 Network Sniffing |
Responder captures hashes and credentials that are sent to the system after the name services have been poisoned. |
| T1557.001 Name Resolution Poisoning and SMB Relay |
Responder is used to poison name services to gather hashes and credentials from systems within a local network. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
