Our take
Quietno commits in the last 90 days and no release in a year- Activity
- 20
- Community
- 60
- Issues
- 21
- Pull requests
- 21
Responder is a broad Python toolkit for authorized network security testing, but its quiet recent development makes it important to validate its fit and maintenance needs before adoption.
Good fit if
- You need to assess name-resolution and authentication exposure across several network protocols.
- Your work is on Linux, or you can account for the service and port limitations documented for macOS.
- Your team can comply with the GPL-3.0 license and restrict use to authorized environments.
Look elsewhere if
- You need a project with recent commits, releases, or demonstrated recent issue and pull-request handling. The repository has no commits in the last 90 days, no release in a year, and no issues closed or pull requests merged in that period.
- You need a project with CI or tests reported in its repository metadata.
- You need a tool that does not collect credentials or authentication material.
All health signals
| Last commit | 2026-06-10 (5 months ago) |
|---|---|
| Commits, last 90 days | 0 |
| Releases, last 12 months | 0 |
| Contributors | 72 (top contributor: 72% of commits) |
| Issues closed, last 90 days | 0 |
| Pull requests merged, last 90 days | 0 |
| Project age | 10 years |
Checked on 2026-11-06 with the GitHub API.
Overview
Responder is a Python network security tool for assessing exposure to LLMNR, NBT-NS, and mDNS name-resolution attacks. It answers failed name-resolution requests and provides rogue authentication servers that can capture authentication exchanges, making it relevant to authorized security assessments and defensive testing.
The project targets Linux and also documents macOS support. Its broad protocol coverage includes HTTP, SMB, LDAP, Kerberos, and other network services. Because it can collect credentials and hashes, use it only in environments where testing is explicitly authorized.
Key Features
- Responds to LLMNR, NBT-NS, and mDNS requests, with an analysis mode for passive observation.
- Provides rogue authentication servers across HTTP, SMB, MSSQL, FTP, LDAP, Kerberos, DNS, and other protocols.
- Supports NTLMv1, NTLMv2, LMv2, Extended Security NTLMSSP, and several cleartext or challenge-response authentication methods.
- Includes DHCP and DHCPv6 components that can be enabled separately.
- Logs captured data to files and an SQLite database.
- Offers configuration controls for protocol services and poisoning behavior.
- Documents Linux setup and a macOS launcher, including platform-specific service conflicts.
Use Cases
- Red teams can assess, with authorization, whether an internal network is exposed to name-resolution poisoning and credential capture.
- Blue teams can observe name-resolution traffic and evaluate controls such as disabling LLMNR or using DHCP and IPv6 guard features.
- Security educators can demonstrate authentication risks in an isolated lab using test accounts and systems.
- Incident responders can use its documented indicators to help identify rogue name-resolution or authentication services.
What you need
Detected in the repository
- Python (from pyproject.toml)
License in plain words
GPL-3.0strong copyleft
- Commercial use: yes
- Modify and redistribute: yes
- You must keep: the license notice
- Share your changes: yes, the full source of anything you distribute that includes it, under the GPL
- Includes an explicit patent grant from the contributors:
A summary, not legal advice: the LICENSE file is what applies.
Getting Started
The README documents installation with Python 3 and system privileges on Linux, plus a macOS launcher. Review the README and configuration before use, and follow it only in an explicitly authorized environment.
Alternatives
- Coercer: Coercer triggers Windows authentication through vulnerable RPC methods, while Responder targets name-resolution requests and provides rogue authentication servers.
| Project | Language | License | Stars | Status |
|---|---|---|---|---|
| Responder | Python | GPL-3.0 | 6.7k | Quiet |
| Coercer | Python | GPL-2.0 | 2.3k | Quiet |
Considerations
The project is marked quiet: there have been no commits in the last 90 days or releases in the past year. Its contributor base is not concentrated in one person, but the measured data shows no recent issue closures or merged pull requests. Repository metadata reports Python as the runtime and no CI or tests. Responder requires elevated privileges for typical network operation, and its credential-capture capabilities create operational and legal risks outside a controlled, authorized assessment. GPL-3.0 applies to use and redistribution.
Found this useful?
Share it with someone who would like Responder.