skills.rest
Carlos-Reyes-UTP
Carlos-Reyes-UTPCOMMUNITY
Explore all skills by this author →
GitHub

hunt-ntlm-info

Detects credential-reuse risk from exposed NTLMv1/v2 hashes in PCAP files.

2|Updated Apr 11, 2025
Search Tags:#sharepoint#exchange#information disclosure#iis#active directory#ntlm#recon triage
One-click install
npx skills add https://github.com/Carlos-Reyes-UTP/Desarrollo-de-Sistema-de-Ventas-Empresas-de-Moda --skill hunt-ntlm-info
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-ntlm-info
Source: https://github.com/Carlos-Reyes-UTP/Desarrollo-de-Sistema-de-Ventas-Empresas-de-Moda/tree/main/.agent/skills/hunt-ntlm-info
Command: npx skills add https://github.com/Carlos-Reyes-UTP/Desarrollo-de-Sistema-de-Ventas-Empresas-de-Moda --skill hunt-ntlm-info

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It helps investigators identify and extract sensitive NTLM/Negotiate information disclosures from internet-reachable enterprise web services so they can prioritize real risk and reporting.

Core Features & Use Cases

  • Header and challenge detection: Detects whether endpoints anonymously advertise NTLM/Negotiate via WWW-Authenticate responses.
  • NTLM Type-2 capture & AV_PAIRS decoding: Sends an anonymous NTLM Type-1 probe, captures the returned Type-2 challenge, and decodes AV_PAIRS to recover NetBIOS/DNS names and AD forest topology cues.
  • Environment severity context: Helps distinguish informational intranet-only disclosures from internet-exposed leaks that materially accelerate follow-on attack chaining (e.g., recon for auth attacks).

Use Case Example: When testing an internet-facing IIS/SharePoint/Exchange endpoint, run this skill to extract DNS Tree Name and server hostname from NTLM Type-2 challenge data and include it as evidence of AD topology disclosure.

Quick Start

Use the skill to probe an endpoint you can reach (e.g., a SharePoint REST path) and decode the returned NTLM Type-2 AV_PAIRS to extract internal domain and forest indicators.

Frequently Asked Questions about hunt-ntlm-info

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I extract internal domain and computer names from an NTLM Type-2 challenge?▼

You can extract internal NetBIOS/DNS domain and computer names by sending an anonymous NTLM Type-1 probe to an internet-reachable endpoint and decoding the AV_PAIRS in the returned Type-2 challenge according to MS-NLMP.

What is NTLM information disclosure on internet-facing IIS and SharePoint endpoints?▼

NTLM information disclosure occurs when web endpoints advertise NTLM or Negotiate via WWW-Authenticate headers, leaking internal Active Directory topology details like DNS tree names and server hostnames through the Type-2 challenge response.

Can I use this to probe Exchange endpoints for Active Directory forest topology cues?▼

Yes, you can probe internet-facing Exchange endpoints anonymously to capture NTLM Type-2 challenges and decode AV_PAIRS, recovering AD forest topology cues and internal domain indicators for security triage.

How do I decode NTLM AV_PAIRS for security triage and reporting?▼

Decode NTLM AV_PAIRS by handling the Type-1 and Type-2 exchange according to MS-NLMP specifications, extracting NetBIOS/DNS names and timestamps to produce indicators suitable for prioritizing risk and reporting.

Does probing for NTLM leaks require authentication on the target web services?▼

No, probing for NTLM leaks applies to anonymous reconnaissance scenarios where endpoints disclose sensitive information without requiring authentication, capturing the Type-2 challenge to assess environment severity.

What distinguishes internet-exposed NTLM leaks from intranet-only disclosures?▼

Internet-exposed NTLM leaks materially accelerate follow-on attack chaining by revealing AD topology to external attackers, whereas intranet-only disclosures are informational and pose lower immediate risk to security posture.

Related Skills

Explore More Legal & Compliance Skills→
jellaharshithjellaharshith
1

hunt-ntlm-info

Capture and decode NTLM Type-2 AV_PAIRS from IIS, SharePoint, and Exchange endpoints.

Community
Intermediate
sseshachalasseshachala

hunt-ntlm-info

Decode NTLM AV_PAIRS from internet-facing IIS, SharePoint, and Exchange endpoints.

Community
Advanced
elementalsoulselementalsouls
3.3k

hunt-ntlm-info

Capture NTLM Type-2 challenges and decode AV_PAIRS to reveal AD topology.

Community
Advanced
brucesongsbrucesongs
60

ad-ldap-attack

Enumerate Active Directory LDAP environments to reveal users, groups, SPNs, and credential artifacts.

Community
Advanced