skills.rest
uphiago
uphiagoCOMMUNITY
Explore all skills by this author →
Website𝕏@uphiagoGitHub

exchange-owa-attack

Extract Active Directory domain and NetBIOS metadata from NTLM Type-2 challenges.

1.1k|191|Updated Jun 24, 2026
Search Tags:#penetration-testing#active-directory#exchange#recon#ntlm#password-spray#owa
One-click install
npx skills add https://github.com/uphiago/recon-skills --skill exchange-owa-attack
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: exchange-owa-attack
Source: https://github.com/uphiago/recon-skills/tree/main/recon/exchange-owa-attack
Command: npx skills add https://github.com/uphiago/recon-skills --skill exchange-owa-attack

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Standard reconnaissance workflows often miss critical Active Directory metadata, unsecured Exchange admin endpoints, and password spray vulnerabilities in Microsoft Exchange and Outlook Web Access deployments, leaving blind spots in penetration tests and red team engagements.

Core Features & Use Cases

  • NTLM Type-2 Challenge Decoding: Extracts AD domain name, NetBIOS names, computer names, and timestamps from unauthenticated NTLM responses to map internal Active Directory structure.
  • Exchange Endpoint Mapping: Probes core OWA, ECP, EWS, Autodiscover, and other endpoints to identify open services, admin panels, and vulnerable APIs.
  • Password Spray Surface Assessment: Tests for rate limiting, account lockout policies, and Basic Auth enablement to evaluate brute force risk without triggering account locks.
  • Hybrid/Cloud Recon: Maps ADFS instances and Office 365 tenant configurations for hybrid Exchange environments. Use case: For a penetration test of a target with a mail. subdomain, use this skill to quickly confirm Exchange deployment, pull internal AD details from NTLM responses, and identify if password spraying is viable.

Quick Start

Use the exchange-owa-attack skill to perform full reconnaissance on the target mail subdomain owa.targetcompany.com, extract all Active Directory intelligence, map open Exchange endpoints, and assess password spray risk.

Frequently Asked Questions about exchange-owa-attack

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I extract Active Directory domain information from an Exchange OWA endpoint?▼

You can extract Active Directory domain information from an Exchange OWA endpoint by decoding unauthenticated NTLM Type-2 challenge responses, which reveal internal AD domain names, NetBIOS names, and computer names without needing valid credentials.

Can I test password spray viability on an OWA login without triggering account lockouts?▼

You can assess OWA password spray viability by probing for rate limiting, account lockout policies, and Basic Auth enablement, allowing you to evaluate brute force risk on Exchange endpoints without actually triggering account locks.

What is the best way to map hidden Exchange admin endpoints during a penetration test?▼

The best way to map hidden Exchange admin endpoints is to probe core OWA, ECP, EWS, and Autodiscover services, identifying open admin panels and vulnerable APIs to close reconnaissance gaps on corporate mail infrastructure.

Do I need specialized commercial tools to perform NTLM reconnaissance on Exchange?▼

You do not need specialized commercial tools to perform NTLM reconnaissance on Exchange; standard utilities like curl and python3 are sufficient to decode NTLM challenges and probe mail infrastructure misconfigurations.

Does this approach work for hybrid Exchange environments and Office 365 tenants?▼

Yes, this reconnaissance approach applies to hybrid Exchange environments and Office 365 tenants, mapping ADFS instances and tenant configurations alongside on-premises Exchange and OWA web interfaces.

When should I not use unauthenticated NTLM probing for Active Directory recon?▼

You should not use unauthenticated NTLM probing when a target Exchange deployment lacks exposed NTLM authentication endpoints, as the technique relies entirely on intercepting Type-2 challenge responses from OWA or EWS interfaces.

Related Skills

Explore More Software Engineering Skills→
EntroVyxEntroVyx
3

exchange-owa-attack

Probe Exchange and OWA HTTP headers and endpoints for versioning and service availability.

Community
Advanced
AeonDaveAeonDave
15

kerbrute

Enumerate Active Directory usernames and test passwords via Kerberos pre-authentication.

Community
Intermediate
rahmatullahbossrahmatullahboss

Active Directory Attacks

Test Windows Active Directory security with reconnaissance, credential extraction, and Kerberos attacks.

Community
Advanced
hardw00thardw00t
90

network-pentest

Simulate attacker techniques across internal networks and Active Directory environments.

Community
Advanced