hunt-ntlm-info

NTLM information disclosure leaks internal AD topology through AV_PAIRS in NTLM Type-2 challenges. Capturing these challenges from internet-facing endpoints reveals NetBIOS domain names, DNS domain names, and timestamps, exposing internal infrastructure details to unauthorized observers.

Yes, you can capture NTLM challenges from internet-facing IIS and SharePoint endpoints. The Skill probes targets advertising WWW-Authenticate: NTLM or Negotiate, extracting Type-2 challenges and decoding AV_PAIRS to identify internal hostnames, domain names, and forest structure.

NTLM AV_PAIRS exposed through Windows authentication endpoints include NetBIOS Domain Name, DNS Domain Name, DNS Tree Name, and Timestamp. These identifiers are extracted from Type-2 challenge responses to map AD forest and domain structure during authorized security assessments.

Default Windows-installer hostnames appear in NTLM authentication responses because of lazy provisioning during server setup. These default names are broadcast in AV_PAIRS when endpoints advertise NTLM or Negotiate authentication, signaling misconfiguration and revealing internal naming conventions.

Yes, this works for authorized red-team assessments and security research targeting Exchange servers. The Skill probes internet-reachable Exchange, IIS, and SharePoint endpoints advertising NTLM or Negotiate authentication, decoding AV_PAIRS to assess AD topology exposure and identify misconfigurations.

NTLM information disclosure severity depends on exposure context, with internet-facing endpoints leaking AV_PAIRS posing significant risk. The Skill provides a severity note based on what internal AD topology details—NetBIOS names, DNS domains, timestamps—are exposed through Type-2 challenge responses.