domains / families / security / exchange-owa-attack

exchange-owa-attack

separate

Exchange/OWA NTLM AD leak, spray attack when mail subdomain.

When to use

• Target has `owa.`, `mail.`, `webmail.`, `exchange.`, or `autodiscover.` subdomains.
• crt.sh reveals Exchange-related SAN names (`mail.domain.com`, `autodiscover.domain.com`).
• Port 443 returns NTLM `WWW-Authenticate: Negotiate` or `WWW-Authenticate: NTLM`.
• After `subdomain-enumeration` discovers mail-related hosts.
• After `port-service-discovery` finds HTTPS on port 443 with Exchange fingerprints.

When not to use

• password or lockout testing without explicit authorization
• password or lockout testing without approved identities

Skill page

Source