v1.1.0

Changes since v1.0.0:

Capture and poisoning

• Persistent credential DB: already-captured accounts are flagged as KNOWN across runs
• Rich capture output: protocol-coloured cards showing account, hashcat mode and hash
• Selective poisoning (-selective): fingerprints hosts via SMB signing probe, skips signing-required targets
• Analyze mode (-A): log all queries without poisoning

Bug fixes

• Correct SMB2_FLAGS_SERVER_TO_REDIR in victim-facing responses
• Fixed SecurityMode negotiation in SOCKS proxy path
• Fixed credit-charge accounting in SMB2 proxy loop (CreditCharge > 1 caused TCP RST)

v1.0.0

go-responder v1.0.0

Static NTLMv1/NTLMv2 hash capture tool - zero dependencies, single binary.

Protocols

• Poisoners: LLMNR, NBT-NS, mDNS, DNS
• Servers: SMB (v1+v2), HTTP, HTTPS, FTP, SMTP, POP3, IMAP, LDAP, DCE-RPC, MSSQL, Kerberos, WinRM, HTTP Proxy

Features

• NTLMv2 hash capture across all protocols
• Cleartext credential capture (FTP, SMTP, LDAP simple bind)
• WPAD PAC file serving
• Trigger file generation (SCF, URL, LNK, desktop.ini)
• IP/hostname allow/deny filtering
• NTLMv1 downgrade (-lm)
• Analyze mode (-A)

Binaries

File	OS	Arch
go-responder-linux-amd64	Linux	x86_64
go-responder-windows-amd64.exe	Windows	x86_64

Usage

```
sudo ./go-responder-linux-amd64 -i eth0 -v
```