Instructor: Responder. 2 2
In this short video, we are going to talk 3 3
about the tool known as Responder. 4 4
Now Responder comes as part 5 5
of the Kali Open-Source Penetration Testing System. 6 6
Responder is a command line tool that's used 7 7
to poison responses to NetBIOS, LLMNR 8 8
and MDNS name resolution request 9 9
in an attempt to perform a man-in-the-middle attack. 10 10
Essentially, Responder's designed 11 11
to intercept those messages 12 12
and those requests and return the attacker's host IP 13 13
as the name of record. 14 14
Now, the benefit of using something like Responder 15 15
in penetration testing is you can get into the system 16 16
and you can actually become that man in the middle. 17 17
This is actually really useful when you're dealing 18 18
with something like Windows file sharing 19 19
or server message block messages 20 20
over SMB because this can allow the attacker 21 21
to retrieve the password hashes 22 22
and then try to crack those later on. 23 23
Now, when you use Responder for this attack to work, 24 24
the victim system must be 25 25
either tricked into querying a non-existent name 26 26
or prevented from using the legitimate DNS service. 27 27
If they can't reach the real DNS service, 28 28
the way Windows works is it's going to do as a backup 29 29
of asking other people in the network for that DNS name, 30 30
and when it does that, Responder can then say, 31 31
"Hey I have the answer for you," 32 32
and give you your IP address, 33 33
so they now are connecting to you 34 34
and you become the man in the middle. 35 35
That's the idea of how this works. 36 36
Now another thing that you as a defender can use Responder 37 37
for is to place it into analysis mode. 38 38
If you do that, you can monitor the name resolution traffic 39 39
without responding across the network 40 40
so you can detect if other people are trying to 41 41
poison your name resolution inside your network.