hunt-ntlm-info

To detect NTLM information disclosure on IIS and SharePoint services, you analyze NTLMSSP challenge responses to extract internal AD domain, computer name, and timestamp information from specific HTTP endpoints requiring NTLM authentication.

An NTLM Type-2 challenge response exposes internal Active Directory topology data by decoding AV_PAIRS, specifically revealing the internal AD domain, default computer name, and timestamp information from the target server.

Yes, you can scan Exchange services for NTLM authentication details without credentials by probing targeted HTTP endpoints that use NTLM authentication and analyzing the server's challenge response headers for internal information.

Yes, you need direct network access to the target IIS, SharePoint, or Exchange services to send specific HTTP headers indicating NTLM authentication and capture the NTLMSSP challenge responses for analysis.

The best way to audit enterprise environments for NTLM Negotiate information disclosure is to automatically identify and scan internet-reachable IIS, SharePoint, and Exchange endpoints, then decode the challenge responses to report exposed internal topology.

Analyzing NTLM authentication headers reveals internal computer names because the NTLMSSP challenge response mechanism includes AV_PAIRS that encode default hostnames and internal AD domain details for enterprise authentication routing.