hunt-ntlm-info

Capture NTLM Type-2 challenges and decode AV_PAIRS to reveal AD topology.

3.3k|507|Updated May 5, 2026

Search Tags:#sharepoint #negotiate #iis #ntlm #av_pairs #ad-topology #info-disclosure

Ready to run

npx skills add https://github.com/elementalsouls/Claude-BugHunter --skill hunt-ntlm-info-elementalsouls

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-ntlm-info
Source: https://github.com/elementalsouls/Claude-BugHunter/tree/main/skills/hunt-ntlm-info
Command: npx skills add https://github.com/elementalsouls/Claude-BugHunter --skill hunt-ntlm-info-elementalsouls

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Hunt NTLM/Negotiate information disclosure on internet-reachable IIS/SharePoint/Exchange to reveal internal AD topology through AV_PAIRS in NTLM Type-2 challenges. Default Windows-installer hostnames signal lazy provisioning and help identify potential misconfigurations.

Core Features & Use Cases

NTLM Type-2 capture and AV_PAIRS decoding to reveal NetBIOS and DNS topology information.
extraction of critical identifiers (NetBIOS Domain Name, DNS Domain Name, DNS Tree Name, Timestamp) to map AD structure.
Useful for authorized red-team assessments and security research to assess exposure of AD topology via NTLM disclosures.

Quick Start

Proactively probe internet-facing NTLM-enabled endpoints to capture NTLM Type-2 challenges and decode AV_PAIRS for forest and domain discovery.

Frequently Asked Questions about hunt-ntlm-info

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I extract AD topology information from NTLM Type-2 challenges?▼

NTLM information disclosure leaks internal AD topology through AV_PAIRS in NTLM Type-2 challenges. Capturing these challenges from internet-facing endpoints reveals NetBIOS domain names, DNS domain names, and timestamps, exposing internal infrastructure details to unauthorized observers.

Can I capture NTLM challenges from internet-facing IIS and SharePoint endpoints?▼

Yes, you can capture NTLM challenges from internet-facing IIS and SharePoint endpoints. The Skill probes targets advertising WWW-Authenticate: NTLM or Negotiate, extracting Type-2 challenges and decoding AV_PAIRS to identify internal hostnames, domain names, and forest structure.

What NTLM AV_PAIRS are exposed through Windows authentication endpoints?▼

NTLM AV_PAIRS exposed through Windows authentication endpoints include NetBIOS Domain Name, DNS Domain Name, DNS Tree Name, and Timestamp. These identifiers are extracted from Type-2 challenge responses to map AD forest and domain structure during authorized security assessments.

Why do default Windows-installer hostnames appear in NTLM authentication responses?▼

Default Windows-installer hostnames appear in NTLM authentication responses because of lazy provisioning during server setup. These default names are broadcast in AV_PAIRS when endpoints advertise NTLM or Negotiate authentication, signaling misconfiguration and revealing internal naming conventions.

Does this work for red-team assessments targeting Exchange servers?▼

Yes, this works for authorized red-team assessments and security research targeting Exchange servers. The Skill probes internet-reachable Exchange, IIS, and SharePoint endpoints advertising NTLM or Negotiate authentication, decoding AV_PAIRS to assess AD topology exposure and identify misconfigurations.

What severity does NTLM information disclosure pose for exposed AD topology?▼

NTLM information disclosure severity depends on exposure context, with internet-facing endpoints leaking AV_PAIRS posing significant risk. The Skill provides a severity note based on what internal AD topology details—NetBIOS names, DNS domains, timestamps—are exposed through Type-2 challenge responses.