hunt-ntlm-info

Detect NTLM information disclosure on IIS servers by probing anonymous endpoints for NTLM/Negotiate authentication headers. This process captures and parses NTLMSSP Type-2 challenge messages to extract sensitive internal Active Directory topology details.

Extracting NTLMSSP Type-2 challenge messages during a security audit reveals NetBIOS names, DNS forest structures, and server timestamps. This decoded AV_PAIR data exposes internal domain names and default Windows hostnames from enterprise infrastructure.

Yes, you can audit Exchange and SharePoint servers for NTLM authentication leaks. The skill probes these internet-reachable web-based enterprise services to map internal Active Directory topology and identify server configuration vulnerabilities.

Map internal Active Directory topology from external reconnaissance by capturing NTLM handshake data from public-facing enterprise services. Analyzing the decoded Type-2 challenge messages reveals internal domain naming structures and server configurations.

Yes, raw socket communication capabilities are required to capture NTLM negotiate headers. Maintaining persistent connections is necessary for successful NTLM handshake analysis and accurate Type-2 challenge message parsing.

NTLM reconnaissance fails to retrieve DNS forest information when persistent raw socket connections are not maintained. Successful AV_PAIR decoding requires maintaining the connection throughout the entire NTLM handshake analysis process.