1 1 00:00:00,240 --> 00:00:01,650 Responder. 2 2 00:00:01,650 --> 00:00:03,450 In this short video, we are going to talk 3 3 00:00:03,450 --> 00:00:05,760 about the tool known as Responder. 4 4 00:00:05,760 --> 00:00:07,020 Now Responder comes as part 5 5 00:00:07,020 --> 00:00:10,170 of the Kali Open-Source Penetration Testing System. 6 6 00:00:10,170 --> 00:00:12,090 Responder is a command line tool that's used 7 7 00:00:12,090 --> 00:00:15,660 to poison responses to NetBIOS, LLMNR 8 8 00:00:15,660 --> 00:00:17,940 and MDNS name resolution request 9 9 00:00:17,940 --> 00:00:20,790 in an attempt to perform a man-in-the-middle attack. 10 10 00:00:20,790 --> 00:00:22,470 Essentially, Responder's designed 11 11 00:00:22,470 --> 00:00:24,300 to intercept those messages 12 12 00:00:24,300 --> 00:00:27,360 and those requests and return the attacker's host IP 13 13 00:00:27,360 --> 00:00:29,160 as the name of record. 14 14 00:00:29,160 --> 00:00:31,320 Now, the benefit of using something like Responder 15 15 00:00:31,320 --> 00:00:33,987 in penetration testing is you can get into the system 16 16 00:00:33,987 --> 00:00:36,840 and you can actually become that man in the middle. 17 17 00:00:36,840 --> 00:00:38,610 This is actually really useful when you're dealing 18 18 00:00:38,610 --> 00:00:40,290 with something like Windows file sharing 19 19 00:00:40,290 --> 00:00:42,120 or server message block messages 20 20 00:00:42,120 --> 00:00:44,610 over SMB because this can allow the attacker 21 21 00:00:44,610 --> 00:00:46,380 to retrieve the password hashes 22 22 00:00:46,380 --> 00:00:48,660 and then try to crack those later on. 23 23 00:00:48,660 --> 00:00:51,240 Now, when you use Responder for this attack to work, 24 24 00:00:51,240 --> 00:00:52,650 the victim system must be 25 25 00:00:52,650 --> 00:00:55,320 either tricked into querying a non-existent name 26 26 00:00:55,320 --> 00:00:58,350 or prevented from using the legitimate DNS service. 27 27 00:00:58,350 --> 00:01:00,540 If they can't reach the real DNS service, 28 28 00:01:00,540 --> 00:01:03,150 the way Windows works is it's going to do as a backup 29 29 00:01:03,150 --> 00:01:06,690 of asking other people in the network for that DNS name, 30 30 00:01:06,690 --> 00:01:08,767 and when it does that, Responder can then say, 31 31 00:01:08,767 --> 00:01:10,680 "Hey I have the answer for you," 32 32 00:01:10,680 --> 00:01:12,600 and give you your IP address, 33 33 00:01:12,600 --> 00:01:14,190 so they now are connecting to you 34 34 00:01:14,190 --> 00:01:15,930 and you become the man in the middle. 35 35 00:01:15,930 --> 00:01:18,000 That's the idea of how this works. 36 36 00:01:18,000 --> 00:01:20,730 Now another thing that you as a defender can use Responder 37 37 00:01:20,730 --> 00:01:23,280 for is to place it into analysis mode. 38 38 00:01:23,280 --> 00:01:26,070 If you do that, you can monitor the name resolution traffic 39 39 00:01:26,070 --> 00:01:28,290 without responding across the network 40 40 00:01:28,290 --> 00:01:30,330 so you can detect if other people are trying to 41 41 00:01:30,330 --> 00:01:32,730 poison your name resolution inside your network.