hunt-ntlm-info

NTLM information disclosure exposes Active Directory topology by sending an anonymous Type-1 challenge to IIS or SharePoint endpoints, receiving a Type-2 NTLMSSP response, and decoding AV_PAIRS. This reveals internal domain names, computer names, and timestamps typically hidden from unauthenticated users.

Decoding NTLMSSP Type-2 responses for AD topology mapping involves parsing the WWW-Authenticate: NTLM header in a keep-alive session per MS-NLMP specifications. Extracted AV_PAIRS yield NetBIOS domain names, DNS forest trees, and computer names to map internal network structures.

Yes, you can capture NTLM metadata from Exchange endpoints anonymously by probing common paths like EWS autodiscover, EWS ASMX, and OWA. The endpoint returns a Type-2 challenge containing AV_PAIRS that disclose internal hostname and domain details without requiring valid credentials.

Triage NTLM reconnaissance leaks by mapping extracted AV_PAIRS to severity tiers, prioritizing high-value disclosures like default Windows hostnames and forest topology leaks. This categorization helps identify the most critical Active Directory information exposure for report-ready output.

Probing for NTLM Type-2 responses does not require authentication. The Skill sends an anonymous NTLM Type-1 challenge to internet-reachable IIS, SharePoint, or Exchange endpoints, prompting the server to return a Type-2 response containing internal environment metadata.