During a network security assessment, several hosts broadcast name queries due to default configurations. Which tool helps intercept those queries and capture hashed authentication data from devices sending them?
Responder is purpose-built to spoof LLMNR/NBNS/mDNS requests and capture the resulting NTLM authentication hashes from unwitting hosts. Netcat, Nmap, and CrackMapExec serve other roles—port scanning, raw socket communication, or authenticated post-exploitation—and lack broadcast-spoofing functionality. Therefore, Responder is the most effective tool for intercepting these queries and harvesting hashes.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is LLMNR and NBNS?
Open an interactive chat with Bash
How does Responder capture NTLM hashes?
Open an interactive chat with Bash
What is the significance of NTLM hashes in penetration testing?