exchange-owa-attack

What problem does it solve?

Standard reconnaissance workflows often miss critical Active Directory metadata, unsecured Exchange admin endpoints, and password spray vulnerabilities in Microsoft Exchange and Outlook Web Access deployments, leaving blind spots in penetration tests and red team engagements.

Core Features & Use Cases

• NTLM Type-2 Challenge Decoding: Extracts AD domain name, NetBIOS names, computer names, and timestamps from unauthenticated NTLM responses to map internal Active Directory structure.
• Exchange Endpoint Mapping: Probes core OWA, ECP, EWS, Autodiscover, and other endpoints to identify open services, admin panels, and vulnerable APIs.
• Password Spray Surface Assessment: Tests for rate limiting, account lockout policies, and Basic Auth enablement to evaluate brute force risk without triggering account locks.
• Hybrid/Cloud Recon: Maps ADFS instances and Office 365 tenant configurations for hybrid Exchange environments. Use case: For a penetration test of a target with a mail. subdomain, use this skill to quickly confirm Exchange deployment, pull internal AD details from NTLM responses, and identify if password spraying is viable.

Quick Start

Use the exchange-owa-attack skill to perform full reconnaissance on the target mail subdomain owa.targetcompany.com, extract all Active Directory intelligence, map open Exchange endpoints, and assess password spray risk.