hunt-ntlm-info

## Crown Jewel Targets NTLM info disclosure is a **Medium-severity finding when chained to context** — the leak itself is intentional protocol behavior (RFC-compliant NTLMSSP challenge), but on internet-exposed enterprise infrastructure it provides exact reconnaissance for the next stage of an attack. Highest-value targets: - **Internet-reachable IIS / SharePoint / Exchange / OWA** with dual-auth (Forms + NTLM, or NTLM + Kerberos) - **Citrix NetScaler / VMware Horizon View** internet-facing gateways with NTLM-backed AD auth - **Lync / Skype for Business / Teams On-Prem** edge servers - **WSUS / Windows Update Services** with NTLM-protected admin paths - **CIFS-style fileshare proxies** (HCL Sametime, IBM Notes Domino) that proxy NTLM - **Legacy SharePoint farms** that left NTLM enabled on the public-zone IIS binding **What makes this pay:** - Internal AD domain disclosure (parent-forest mapping, e.g. `customer.parent-corp.example` → tenant inside corporate-AD tree) - Default-Windows-hostname disclosure (`WIN-XXXXXXXXXXX` pattern signals rushed provisioning → likely default service-account passwords) - Timestamp leak (used in NTLMv2 hash cracking acceleration) - Direct attack-map enrichment for credential spraying combined with `hunt-auth-bypass` Legacy-Protocol Matrix --- ## Attack Surface Signals **Response headers signaling NTLM availability:** ``` WWW-Authenticate: NTLM WWW-Authenticate: Negotiate WWW-Authenticate: NTLM, Negotiate WWW-Authenticate: Negotiate, NTLM ``...