Responder is a network credential capture tool that poisons name resolution protocols to trick systems into sending authentication requests. Attackers use it to harvest NTLM hashes and relay credentials for lateral movement. Defenders should disable unnecessary legacy name resolution, segment networks and monitor for spoofed responder traffic.
How Responder Works
Responder is not a general scanner, it is a name resolution poisoning tool that waits for systems to broadcast authentication requests and then tricks them into disclosing NTLM material. The danger comes from abusing ordinary Windows name resolution behaviour, so the tool can turn routine network chatter into credential exposure.
Because the technique relies on legacy protocols and broadcast trust, it is effective in environments that still allow unnecessary fallback resolution. Even when the tool itself is simple, the impact can be severe because harvested responses can become the starting point for authentication relay and later movement across the network.
Why It Is Dangerous in Windows Networks
The threat is strongest where systems still accept LLMNR, NBT-NS, or similar legacy resolution paths. In those environments, a spoofed response can make a workstation or server send authentication attempts to the attacker instead of the real destination, exposing NTLM hashes or challenge-response material that can be reused or relayed.
This makes Responder especially dangerous in mixed or poorly segmented networks, where one successful capture can lead to broader compromise. NHIMG’s Lateral Movement Guide covers how NTLM relay, Pass-the-Hash style activity, and remote service abuse fit into the wider attack chain.
How Defenders Check Exposure
Exposure checks begin with understanding where legacy name resolution is still enabled and which subnets can receive spoofed responses. Teams should inventory Windows hosts, review resolver configuration, and identify whether authentication traffic can be elicited from endpoints, servers, jump hosts, or administrator workstations.
It is also important to assess whether the network design allows an attacker to hear and answer local broadcasts. Segmentation, broadcast domain size, and placement of high-value systems all affect whether a single spoofing foothold can be turned into credential capture at scale. NIST Cybersecurity Framework 2.0 is a useful high-level reference for organising identification, protection, detection, response, and recovery around this kind of exposure.
Detection, Containment, and Hardening
Detection focuses on suspicious name resolution replies, unexpected NTLM authentication patterns, and systems that suddenly authenticate to unknown listeners. Defenders should look for spoofed responder traffic, unusual SMB or HTTP authentication attempts, and signs that a captured challenge-response exchange is being replayed or relayed elsewhere.
Hardening usually means removing the protocol paths the tool exploits, reducing flat network reachability, and preferring stronger authentication flows where possible. NIST SP 800-207 Zero Trust Architecture supports the broader principle of limiting implicit trust between hosts, while NIST SP 800-53 Rev 5 Security and Privacy Controls maps well to least privilege, monitoring, and configuration discipline for reducing the blast radius of this technique.
Risk and Threat Considerations
Responder turns ordinary trust in local name resolution into a credential harvesting opportunity. The main risk is not just one captured hash, but the possibility that a captured authentication exchange becomes a relay path into file shares, remote administration services, or other internal systems.
Failure mechanism: A host accepts a spoofed name resolution answer, sends authentication material to the attacker, and the attacker reuses or relays that material before the victim notices.
Impact: Credential exposure, lateral movement, and broader internal compromise can follow, especially where NTLM remains accepted and segmentation is weak.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1557 — Adversary-in-the-Middle | Responder poisons name resolution to intercept authentication traffic. |
| Recommendation — Detect and block adversary-in-the-middle name resolution poisoning and relay activity. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Limits the reach of captured credentials after relay or reuse. |
| IA-2 — Identification and Authentication (Organizational Users) | Responder exploits authentication requests from enterprise systems. | |
| SI-4 — System Monitoring | Responder traffic is detected through abnormal network and authentication activity. | |
| Recommendation — Enforce least privilege to reduce what captured credentials can access. Harden user authentication flows to reduce reliance on legacy challenge-response paths. Monitor for spoofed resolution and anomalous NTLM authentication patterns. | ||
Practitioner Guidance
Why practitioners should care: Responder is a reminder that protocol convenience can become an attack surface when legacy resolution and weak authentication remain in place. The control decision is less about the tool itself and more about whether the environment still gives an attacker something useful to poison.
What to watch for: Focus on endpoints and subnets that still rely on legacy name resolution, and on any place where authentication requests are likely to cross trust boundaries. The safest posture is to remove unnecessary resolution methods, constrain lateral reach, and monitor for unexpected authentication flows rather than treating the tool as a one-off malware family.