> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/windows-privilege-escalation/monitoring-users/responder-retrieving-and-cracking-hashes.md).

# Responder - Retrieving and Cracking Hashes

{% embed url="<https://github.com/lgandx/Responder>" %}

Responder is a network poisoning and credential-capture tool used in Windows environments. It can answer broadcast name-resolution requests such as LLMNR, NBT-NS, and mDNS, then serve rogue SMB, HTTP, and other services to capture or relay NTLM authentication attempts.

{% code title="Starting up Responder on tun0" %}

```bash
sudo responder -wrf -v -I tun0
```

{% endcode %}

### Triggering NTLM authentication with basic user actions

In many cases, when a user completes a basic action, for example, browsing to a shared folder, opening a directory in Explorer, or clicking a file, can cause the Windows machine to trigger outbound authentication in the network depending on how you set it up. We can then capture this authentication request and crack the hashes offline or relay them. For instance, you may setup malicious .lnk or .scf files that will cause any unsuspecting user that clicks or browses to them to authenticate. See the [Malicious SCF Files](/breakpoint/windows/windows-privilege-escalation/monitoring-users/malicious-scf-files.md) and [Malicious .lnk Files](/breakpoint/windows/windows-privilege-escalation/monitoring-users/malicious-.lnk-files.md) pages.