I wanted to play with Responder. So I installed Kali onto a virtual mashine and made a bridged connection, so that Kali and the host (Win7) share the same network interface.

I changed the Win7 password to "password1" and tried to access a non-existing resource like "\\fielshare". The Responder seems to capture the credentials properly, but I don't understand, what hashes it is capturing.

Per try it captures five different hashes. When I try several times, the hashes never repeat. None of them equals to the Win7-hash corresponding to "password1". So what are they?

I'm using the command responder -I eth0 -v

1 Answer 1


Responder captures NetNTLMv2 responses. You then need to use something like hashcat to crack them, and if your wordlist is good, you will then be able to get the password.

The hash of the response will not match the hash of the password itself, because it contains more information than just that password, such as the server nonce.

See this zone13.io post for some more information. The cracked response with the password visible looks like this:

enter image description here


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .