hunt-ntlm-info

To reveal NTLM information disclosure on IIS and SharePoint servers, capture NTLM Type-2 challenge responses to leak internal Active Directory topology data like NetBIOS domain names and computer names.

Extracting NTLM Type-2 challenge responses leaks reconnaissance data including the internal DNS forest, NetBIOS domain name, computer name, and Active Directory timestamp from the target server.

Yes, you can enumerate Active Directory topology from internet-reachable Exchange servers by targeting NTLM/Negotiate authentication headers to uncover internal DNS forest and default service account information.

To start hunting for NTLM authentication headers, you need network access to the internet-reachable target server and a working knowledge of NTLM protocol specifics to interpret the challenge responses.

This method works specifically on internet-reachable IIS, SharePoint, and Exchange servers that advertise NTLM/Negotiate authentication headers, rather than applying to all internet-facing server types.