hunt-ntlm-info

Identify NTLM/Negotiate information disclosure from IIS, SharePoint, and Exchange servers.

Updated Jul 1, 2026

Search Tags:#SharePoint #information leak #IIS #Exchange #NTLM disclosure

Ready to run

npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill hunt-ntlm-info-bpnrockstar

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-ntlm-info
Source: https://github.com/bpnrockstar/UnifiedBugHunter/tree/main/skills/hunt-ntlm-info
Command: npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill hunt-ntlm-info-bpnrockstar

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill identifies and reveals NTLM/Negotiate information disclosure on internet-reachable IIS/SharePoint/Exchange servers, providing critical reconnaissance data.

Core Features & Use Cases

NTLM/Negotiate Information Disclosure: Captures NTLM Type-2 challenge responses to leak NetBIOS domain, internal DNS forest, computer name, and AD timestamp.
Target Identification: Pinpoints Internet-reachable IIS/SharePoint/Exchange servers with NTLM-based authentication.
Use Case: Use this Skill to uncover internal AD topology and default service account information from servers advertising NTLM/Negotiate authentication headers.

Quick Start

Execute the hunt-ntlm-info skill on the target server.

Frequently Asked Questions about hunt-ntlm-info

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I reveal NTLM information disclosure on IIS and SharePoint servers?▼

To reveal NTLM information disclosure on IIS and SharePoint servers, capture NTLM Type-2 challenge responses to leak internal Active Directory topology data like NetBIOS domain names and computer names.

What data can I extract from NTLM Type-2 challenge responses?▼

Extracting NTLM Type-2 challenge responses leaks reconnaissance data including the internal DNS forest, NetBIOS domain name, computer name, and Active Directory timestamp from the target server.

Can I use this to enumerate Active Directory topology from Exchange servers?▼

Yes, you can enumerate Active Directory topology from internet-reachable Exchange servers by targeting NTLM/Negotiate authentication headers to uncover internal DNS forest and default service account information.

What do I need to start hunting for NTLM authentication headers?▼

To start hunting for NTLM authentication headers, you need network access to the internet-reachable target server and a working knowledge of NTLM protocol specifics to interpret the challenge responses.

Does this method work on any internet-reachable server?▼

This method works specifically on internet-reachable IIS, SharePoint, and Exchange servers that advertise NTLM/Negotiate authentication headers, rather than applying to all internet-facing server types.