Skip to content

Respotter is a Responder honeypot! Catch attackers as soon as they spin up Responder in your environment.

License

Notifications You must be signed in to change notification settings

extremepaperclip/Respotter

 
 

Repository files navigation

Respotter

The Responder Honeypot

This application detects active instances of Responder by taking advantage of the fact that Responder will respond to any DNS query. Respotter uses LLMNR, mDNS, and NBNS protocols to search for a bogus hostname that does not exist (default: Loremipsumdolorsitamet). If any of the requests get a response back, then it means Responder is probably running on your network.

Respotter can send webhooks to Slack, Teams, or Discord. It also supports sending events to a syslog server to be ingested by a SIEM. Webhooks alerts are rate limited to 1 alert per IP per hour.

Quick start

docker run --rm --net=host ghcr.io/lawndoc/respotter

Note: --net=host is required due to privileged socket usage when crafting request packets

Demo

demo gif

Vulnerable host identification

Respotter will also listen for LLMNR, mDNS, and NBNS queries that originate from other hosts. Queries from other hosts will raise an alert, warning that the host may be susceptible to credential theft from Responder. Webhook alerts for vulnerable hosts are rate limited to 1 alert per IP:Protocol per day.

Respotter does NOT attempt to poison responses to sniffed queries. Poisoning responses isn't opsec-safe for the honeypot, and may cause issues with the client. Use Responder to identify accounts that are vulnerable to poisoning once a vulnerable host has been discovered by Respotter.

Other notes

Tools that are similar to Responder such as Inveigh can also be detected because they perform similar spoofing attacks. See LLMNR/NTB-NS Poisoning on Mitre ATT&CK for more details.

Additional configuration

Detailed information on configuration and deployment can be found in the wiki

License

MIT

Contributors

This project was originally created by Baden Erb (@badenerb)

Current maintainers:

About

Respotter is a Responder honeypot! Catch attackers as soon as they spin up Responder in your environment.

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • Python 95.2%
  • Dockerfile 4.8%