2020-08-20 07:42:18 +00:00
|
|
|
id: ntlm-directories
|
|
|
|
|
|
|
|
|
|
info:
|
|
|
|
|
name: Discovering directories w/ NTLM
|
|
|
|
|
author: puzzlepeaches
|
|
|
|
|
severity: info
|
2021-04-01 18:35:08 +00:00
|
|
|
tags: misc
|
2020-08-20 07:42:18 +00:00
|
|
|
|
|
|
|
|
requests:
|
|
|
|
|
- method: GET
|
|
|
|
|
path:
|
|
|
|
|
- "{{BaseURL}}/abs/"
|
|
|
|
|
- "{{BaseURL}}/adfs/services/trust/2005/windowstransport"
|
|
|
|
|
- "{{BaseURL}}/aspnet_client/"
|
|
|
|
|
- "{{BaseURL}}/autodiscover/"
|
|
|
|
|
- "{{BaseURL}}/autoupdate/"
|
|
|
|
|
- "{{BaseURL}}/certenroll/"
|
|
|
|
|
- "{{BaseURL}}/certprov/"
|
|
|
|
|
- "{{BaseURL}}/certsrv/"
|
|
|
|
|
- "{{BaseURL}}/conf/"
|
|
|
|
|
- "{{BaseURL}}/deviceupdatefiles_ext/"
|
|
|
|
|
- "{{BaseURL}}/deviceupdatefiles_int/"
|
|
|
|
|
- "{{BaseURL}}/dialin/"
|
|
|
|
|
- "{{BaseURL}}/ecp/"
|
|
|
|
|
- "{{BaseURL}}/etc/"
|
|
|
|
|
- "{{BaseURL}}/ews/"
|
|
|
|
|
- "{{BaseURL}}/exchange/"
|
|
|
|
|
- "{{BaseURL}}/exchweb/"
|
|
|
|
|
- "{{BaseURL}}/groupexpansion/"
|
|
|
|
|
- "{{BaseURL}}/hybridconfig/"
|
|
|
|
|
- "{{BaseURL}}/mcx/"
|
|
|
|
|
- "{{BaseURL}}/mcx/mcxservice.svc"
|
|
|
|
|
- "{{BaseURL}}/meet/"
|
|
|
|
|
- "{{BaseURL}}/meeting/"
|
|
|
|
|
- "{{BaseURL}}/microsoft-server-activesync/"
|
|
|
|
|
- "{{BaseURL}}/oab/"
|
|
|
|
|
- "{{BaseURL}}/ocsp/"
|
|
|
|
|
- "{{BaseURL}}/owa/"
|
|
|
|
|
- "{{BaseURL}}/persistentchat/"
|
|
|
|
|
- "{{BaseURL}}/phoneconferencing/"
|
|
|
|
|
- "{{BaseURL}}/powershell/"
|
|
|
|
|
- "{{BaseURL}}/public/"
|
|
|
|
|
- "{{BaseURL}}/reach/sip.svc"
|
|
|
|
|
- "{{BaseURL}}/requesthandler/"
|
|
|
|
|
- "{{BaseURL}}/requesthandlerext/"
|
|
|
|
|
- "{{BaseURL}}/rgs/"
|
|
|
|
|
- "{{BaseURL}}/rgsclients/"
|
|
|
|
|
- "{{BaseURL}}/rpc/"
|
|
|
|
|
- "{{BaseURL}}/rpcwithcert/"
|
|
|
|
|
- "{{BaseURL}}/scheduler/"
|
|
|
|
|
- "{{BaseURL}}/ucwa/"
|
|
|
|
|
- "{{BaseURL}}/unifiedmessaging/"
|
|
|
|
|
- "{{BaseURL}}/webticket/"
|
|
|
|
|
- "{{BaseURL}}/webticket/webticketservice.svc"
|
|
|
|
|
- "{{BaseURL}}/webticket/webticketservice.svcabs/"
|
2020-09-09 11:30:30 +00:00
|
|
|
|
|
|
|
|
matchers-condition: and
|
2020-08-20 07:42:18 +00:00
|
|
|
matchers:
|
|
|
|
|
- type: word
|
|
|
|
|
words:
|
2020-09-10 15:43:37 +00:00
|
|
|
- "WWW-Authenticate: NTLM"
|
|
|
|
|
- "Www-Authenticate: NTLM"
|
2020-08-20 07:42:18 +00:00
|
|
|
part: header
|
2020-09-10 15:43:37 +00:00
|
|
|
condition: or
|
2020-09-09 11:30:30 +00:00
|
|
|
|
|
|
|
|
- type: status
|
|
|
|
|
status:
|
|
|
|
|
- 401
|
