domains / families / security / hunt-ntlm-info

hunt-ntlm-info

authentic

Hunt NTLM/Negotiate information disclosure on internet-reachable IIS/SharePoint/Exchange. Anonymous NTLM Type-2 challenge capture leaks NetBIOS domain, internal DNS forest, computer name, AD timestamp via AV_PAIRS structure. Default Windows-installer hostnames (WIN-XXXXXXXXXXX pattern) signal lazy provisioning. Use when target advertises `WWW-Authenticate: NTLM` or `Negotiate` headers anonymously.

When to use

• Internet-reachable IIS / SharePoint / Exchange / OWA
• Citrix NetScaler / VMware Horizon View gateways
• Lync / Skype for Business / Teams On-Prem edge servers
• WSUS / Windows Update Services
• CIFS-style fileshare proxies
• Legacy SharePoint farms
• Anonymous NTLM Type-2 challenge capture
• Default Windows-installer hostname detection

When not to use

• Intranet-only disclosure
• Kerberos golden-ticket forging

Skill page

Source