{# BigBrother Responder.conf template
   Jinja2 variables:
     protocols: dict of protocol toggles (LLMNR, NBT-NS, mDNS, HTTP, SMB, etc.)
     relay_targets: set of IPs excluded from SMB auth (for ntlm_relay)
     interface: network interface
#}
[Responder Core]

; Servers to start
SQL = {{ 'On' if protocols.get('SQL', false) else 'Off' }}
SMB = {{ 'On' if protocols.get('SMB', true) else 'Off' }}
RDP = Off
Kerberos = Off
FTP = {{ 'On' if protocols.get('FTP', false) else 'Off' }}
POP = {{ 'On' if protocols.get('POP', false) else 'Off' }}
SMTP = {{ 'On' if protocols.get('SMTP', false) else 'Off' }}
IMAP = {{ 'On' if protocols.get('IMAP', false) else 'Off' }}
HTTP = {{ 'On' if protocols.get('HTTP', true) else 'Off' }}
HTTPS = {{ 'On' if protocols.get('HTTP', true) else 'Off' }}
DNS = Off
LDAP = {{ 'On' if protocols.get('LDAP', false) else 'Off' }}
DCERPC = Off
WinRM = Off
SNMP = Off
MQTT = Off

; Custom challenge — Random is stealthier than fixed
Challenge = Random

; Set specific interface
; Interface = {{ interface }}

; WPAD configuration
WPADScript = function FindProxyForURL(url, host){return "DIRECT";}
{% if protocols.get('WPAD', true) %}
; WPAD rogue proxy enabled
Serve-Html = On
Serve-Exe = Off
{% endif %}

; Force WPAD auth for hash capture
Force-WPAD-Auth = {{ 'On' if protocols.get('WPAD', true) else 'Off' }}

; Downgrade to NTLMv1 (more crackable but more detectable)
; Set to On only when specifically targeting NTLMv1
Downgrade-To-NTLMv1 = Off

; Don't respond to these machines (comma-separated hostnames)
DontRespondToNames =

{% if relay_targets %}
; Hosts excluded from SMB auth — being relayed by ntlmrelayx
; These IPs should get auth forwarded to ntlmrelayx, not captured locally
DontRespondTo = {{ relay_targets | join(', ') }}
{% else %}
DontRespondTo =
{% endif %}

[HTTP Server]
; Custom HTML to serve for WPAD/HTTP auth
HTMLToInject =
; Serve a custom EXE
Serve-Always = Off
Filename =
ExecParams =

[HTTPS Server]
; Self-signed cert params
SSLCert = certs/responder.crt
SSLKey = certs/responder.key