hunt-ntlm-info

By uphiago. Updated July 25, 2026. Categories: Domain Utilities.

Hunt NTLM/Negotiate information disclosure on internet-reachable IIS/SharePoint/Exchange. Anonymous NTLM Type-2 challenge capture leaks NetBIOS domain, internal DNS forest, computer name, AD timestamp via AV_PAIRS structure. Default Windows-installer hostnames (WIN-XXXXXXXXXXX pattern) signal lazy provisioning. Use when target advertises `WWW-Authenticate: NTLM` or `Negotiate` headers anonymously.

View repository on GitHub

SKILL.md

The description above is the indexed summary. With JavaScript enabled, this page also loads the SKILL.md text from GitHub.