hunt-ntlm-info

Detect NTLM information disclosure by probing anonymous NTLM endpoints on internet-facing IIS and SharePoint to capture Type-2 challenges. This captures NTLM challenges to extract Active Directory topology details like NetBIOS and DNS names for risk assessment.

NTLM Type-2 AV_PAIRS decoding extracts NetBIOS computer and domain names, DNS computer names, DNS domains, DNS tree names, and timestamps. These signals reveal internal forest structure and host naming patterns from anonymous NTLM challenges.

Map Active Directory topology from anonymous Exchange endpoints by capturing Negotiate headers. The skill decodes AV_PAIRS from these NTLM challenges to reveal the DNS tree name and forest root structure for targeted remediation.

NTLM information disclosure risk scoring maps extracted forest and host naming patterns to severity levels. This topology-informed scoring guides triage and remediation planning by contextualizing the exposed Active Directory structure.

Hunt for NTLM info leaks by probing public-facing services to capture an anonymous NTLM Type-2 challenge. Decoding the AV_PAIRS from the challenge provides step-by-step hunting methodology for both blue-team validation and red-team assessment.

IIS advertises NTLM or Negotiate headers anonymously when authentication providers are configured to allow challenge generation before credential submission. This triggers information disclosure by returning Type-2 challenges containing internal AD topology data.