SpiderLabs/Responder

Health v2 · maintenance only

Flags: no_releases archived

Adoption not part of the score

4890 stars · 1804 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

Responder is a Python-based LLMNR, NBT-NS, and mDNS poisoner with built-in rogue authentication servers (SMB, HTTP/S, MSSQL, FTP, LDAP, POP3, IMAP, SMTP, DNS) that captures NTLMv1/v2, LMv2, and cleartext credentials on a network. This SpiderLabs repository is deprecated; active development continues at lgandx/Responder.

Use cases

• poison LLMNR and NBT-NS queries during a pentest
• capture NTLMv2 hashes from Windows machines on a LAN
• run a rogue SMB authentication server to collect credentials
• harvest cleartext credentials from FTP, POP3, IMAP, and SMTP
• test network defenses against name-resolution poisoning attacks

When to choose

• you are conducting an authorized internal network penetration test
• you need to demonstrate LLMNR/NBT-NS poisoning risks to clients
• you want a battle-tested credential-capture tool for red team engagements

When to avoid

• you want active development or recent fixes - use lgandx/Responder instead
• you need a defensive monitoring tool rather than an offensive one
• you lack explicit authorization to test the target network

Facets

cli-tool · maturity maintenance

security networking penetration-testing security penetration-testing networking python cli llmnr nbt-ns mdns credential-harvesting pentest smb ntlm deprecated linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="SpiderLabs/Responder")