hunt-ntlm-info - Hunt NTLM information disclosure
Probe anonymous NTLM challenges on internet-reachable enterprise services and extract domain, host, forest, and timestamp metadata.
Tags
Updated: 2026-10-01Capabilities
Typical Inputs
Typical Outputs
What this skill does
- Probe anonymous endpoints
- Send NTLM Type-1 messages
- Capture Type-2 challenges
- Parse AV_PAIRS metadata
- Assess disclosure severity
- Cross-reference DNS forest data
Inputs
- Target hostname
- HTTP endpoint
- TLS-capable client
- HTTP response headers
Outputs
- NTLM Type-2 challenge data
- NetBIOS host and domain names
- DNS domain and forest names
- Server timestamp
- Disclosure severity assessment
Requirements
- Authorized engagement
- Internet-reachable target
- Keep-alive HTTP support
- Raw TCP/TLS capability