Tool
tool:responder
Tool used to answer local name-resolution requests and capture Net-NTLM authentication hashes.
Tool used to answer local name-resolution requests and capture Net-NTLM authentication hashes.
“The next day he comes in, fires up Responder.”
Network credential-capture tool used to impersonate a missing shared-drive host and collect usernames and password hashes from Windows systems.
“you look for a pen tester that doesn’t fire up Responder”
“That’s when Responder springs into action.”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | USES | password hash | Explicit | 149 |
| incoming | USES | Tinker Secor | Explicit | 36 |
| incoming | USES | Joe Sarkisian | Explicit | 149 |
Tinker Secor USES Responder
Tinker ran Responder to induce systems on the local subnet to disclose Net-NTLM authentication hashes.
Explicit Confidence 99% · Jack Rhysider EP 36 Details
“The next day he comes in, fires up Responder”
“I will run Responder twice a day”
Joe Sarkisian USES Responder
Joe says penetration testers commonly start a network test by running Responder to obtain credentials or hashes.
Explicit Confidence 99% · EvilMog EP 149 Details
“you fire up Responder the second they get on a network”
Responder USES password hash
Responder captures a username and password hash when it impersonates a requested shared drive.
Explicit Confidence 99% · Jack Rhysider EP 149 Details
“it snatches that username and that password hash”