Hunt NTLM/Negotiate information disclosure on internet-reachable IIS/SharePoint/Exchange. Anonymous NTLM Type-2 challenge capture leaks NetBIOS domain, internal DNS forest, computer name, AD timestamp via AV_PAIRS structure. Default Windows-installer hostnames (WIN-XXXXXXXXXXX pattern) signal lazy provisioning.
SkillScore83Maintained
Automatic
◆Security & AppSec pack
Last verified 8/9/2026
What it changes
Passed 19 of 23 test cases with the skill, and 13 of 23 without it.
Without skill57%
With skill83%
Checks it passed that the model alone missed
Recommends configuring IIS Extended Protection to Required.
Identifies /_api/web/CurrentUser as a target endpoint path.
Classifies intranet NTLM disclosure as Informational severity.
and 3 more in the full report
6 fixed13 passed either way4 still failing0 broke
Pass-rate lift
+26 pp
Tokens
+243%
Agent turns
0%
Response time
-32%
Model gemini-3.6-flashMeasured 8/9/2026v119 of 23 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 6
Prompt
What is a common REST endpoint URL path in Microsoft SharePoint that responds to anonymous NTLM Type-1 headers?
What was checked, without and with the skill
Checked
Without skill
With skill
Identifies /_api/web/CurrentUser as a target endpoint path.
Missed
Passed
case-13 · gemini-3.6-flash · 8/9/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md263 linessingle file
Crown Jewel Targets
NTLM info disclosure is a Medium-severity finding when chained to context — the leak itself is intentional protocol behavior (RFC-compliant NTLMSSP challenge), but on internet-exposed enterprise infrastructure it provides exact reconnaissance for the next stage of an attack. Highest-value targets:
Internet-reachable IIS / SharePoint / Exchange / OWA with dual-auth (Forms + NTLM, or NTLM + Kerberos)
Citrix NetScaler / VMware Horizon View internet-facing gateways with NTLM-backed AD auth
Lync / Skype for Business / Teams On-Prem edge servers
WSUS / Windows Update Services with NTLM-protected admin paths
CIFS-style fileshare proxies (HCL Sametime, IBM Notes Domino) that proxy NTLM
Legacy SharePoint farms that left NTLM enabled on the public-zone IIS binding
What makes this pay:
Internal AD domain disclosure (parent-forest mapping, e.g. customer.parent-corp.example → tenant inside corporate-AD tree)