skills.rest
Skobyn
SkobynCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunt-ntlm-info

Detect NTLM Type-2 challenges on IIS, SharePoint, and Exchange servers.

Updated Jun 24, 2026
Search Tags:#SharePoint#bug hunting#red teaming#information disclosure#NTLM#IIS#Exchange
One-click install
npx skills add https://github.com/Skobyn/talon --skill hunt-ntlm-info-skobyn
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-ntlm-info
Source: https://github.com/Skobyn/talon/tree/main/skills/hunt-ntlm-info
Command: npx skills add https://github.com/Skobyn/talon --skill hunt-ntlm-info-skobyn

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill identifies NTLM/Negotiate information disclosure on internet-reachable IIS/SharePoint/Exchange servers, revealing sensitive details like NetBIOS domain, internal DNS forest, and computer name.

Core Features & Use Cases

  • NTLM Information Disclosure: Detects NTLM Type-2 challenges that leak internal network details.
  • Target Identification: Identifies specific targets like IIS, SharePoint, Exchange, and other enterprise platforms.
  • Attack Surface Signals: Identifies NTLM availability in server headers and URL patterns.
  • Hunting Methodology: Provides a step-by-step guide to probing NTLM endpoints and decoding responses.

Quick Start

Use the hunt-ntlm-info skill to scan a target for NTLM information disclosure by running the command 'talon hunt-ntlm-info target.example'.

Frequently Asked Questions about hunt-ntlm-info

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How does NTLM information disclosure leak internal network details on IIS and SharePoint?▼

NTLM Type-2 challenges leak internal network details on internet-reachable IIS and SharePoint servers by exposing the NetBIOS domain name, internal DNS forest, and computer name in server authentication responses.

How do I detect and extract NTLM Type-2 challenges from Exchange servers during red teaming?▼

To extract NTLM Type-2 challenges from Exchange servers, probe NTLM authentication endpoints and decode the server responses to reveal internal DNS forest and computer name data for red-team reconnaissance.

Can I scan internet-reachable IIS servers for NTLM authentication endpoints without prior credentials?▼

Yes, you can scan internet-reachable IIS servers for NTLM endpoints without credentials by analyzing server headers and URL patterns to identify targets that expose NTLM Type-2 challenge responses.

What internal details are exposed through NTLM Negotiate information disclosure on enterprise platforms?▼

NTLM Negotiate information disclosure on enterprise platforms exposes the target server's NetBIOS domain name, internal DNS forest structure, and internal computer name to unauthenticated external requests.

What is the best way to hunt for NTLM information disclosure on enterprise web applications?▼

The best way to hunt for NTLM information disclosure on enterprise web applications is to probe NTLM endpoints on IIS, SharePoint, and Exchange servers and decode the resulting Type-2 challenge responses.

Related Skills

Carlos-Reyes-UTPCarlos-Reyes-UTP
2

hunt-ntlm-info

Detects credential-reuse risk from exposed NTLMv1/v2 hashes in PCAP files.

Community
Advanced
sseshachalasseshachala

hunt-ntlm-info

Decode NTLM AV_PAIRS from internet-facing IIS, SharePoint, and Exchange endpoints.

Community
Advanced
woohyun212woohyun212
21

ad-pentest

Perform six-phase Active Directory penetration testing with BloodHound and ADCS enumeration.

Community
Advanced
bpnrockstarbpnrockstar

hunt-ntlm-info

Identify NTLM/Negotiate information disclosure from IIS, SharePoint, and Exchange servers.

Community
Advanced