Responder

v3.1.4Laurent Gaffié

Answers name-resolution broadcasts and captures NTLMv2 hashes from Windows clients. In the range it emits the authored poisoned-response and captured-hash log the scenario expects, so detections for LLMNR poisoning have something to trip on.

Category: Credential attack & password auditing
Package: responder
Runs on: Linux
Commands: responder, MultiRelay

Emits authored NBT-NS/LLMNR poisoning events. No packet is sent on any real network.

Install it

The scripts below install the real Laurent Gaffié package on your own machine — read them first, and run them somewhere you are allowed to change. Inside the range, one press puts the simulated package on your next machine.

Linux installer (shell script)

install-responder.sh

Windows installer (PowerShell)

Install-responder.ps1

No native Windows build. Use a Linux host in the range, or run it under WSL.

On a range machine

Add it to your kit and every machine you launch comes with it.

On Linux

Debian, Ubuntu, Kali (apt)

Refresh the package lists
```
sudo apt update
```
Install Responder
```
sudo apt install -y responder
```

RHEL, Fedora (dnf)

Install Responder
```
sudo dnf install -y responder
```
Package names drift between distributions; search first if this one misses.

Arch (pacman)

Install Responder
```
sudo pacman -S --noconfirm responder
```

Alpine (apk)

Install Responder
```
sudo apk add responder
```
Package names drift between distributions; search first if this one misses.

Check it worked

Confirm it landed on PATH
```
which responder
```
Check the version
```
responder --version
```
The range reports 3.1.4.

Remove it

Take it off again
```
sudo apt remove --purge responder
```

On Windows

No native Windows build. Use a Linux host in the range, or run it under WSL.

Windows Subsystem for Linux

Install a Linux userland on the Windows host
```
wsl --install -d Ubuntu
```
The upstream project has no native Windows build; WSL is the usual way round it.
Install Responder inside it
```
wsl sudo apt install -y responder
```

Inside the range

Tick it on the launch screen
Under Responder's category on the advanced tool shelf. A lab that depends on it locks the toggle on and says why.
Or install it from a range terminal
```
sudo apt install -y responder
```
The simulated package manager seeds the same binaries, config and receipt the shelf toggle does.
Everything here is simulated
No software is downloaded and nothing executes — the range answers from authored fixtures.

Labs that use Responder

No lab locks this one on yet — tick it on the launch screen and take it into any scenario.