Rapid7 Vulnerability & Exploit Database

Host Information Enumeration via NTLM Authentication

Back to Search

Host Information Enumeration via NTLM Authentication



This module makes requests to resources on the target server in an attempt to find resources which permit NTLM authentication. For resources which permit NTLM authentication, a blank NTLM type 1 message is sent to enumerate a type 2 message from the target server. The type 2 message is then parsed for information such as the Active Directory domain and NetBIOS name. A single URI can be specified with TARGET_URI and/or a file of URIs can be specified with TARGET_URIS_FILE (default).


  • Brandon Knight


Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use auxiliary/scanner/http/ntlm_info_enumeration
msf auxiliary(ntlm_info_enumeration) > show actions
msf auxiliary(ntlm_info_enumeration) > set ACTION < action-name >
msf auxiliary(ntlm_info_enumeration) > show options
    ...show and set options...
msf auxiliary(ntlm_info_enumeration) > run 

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security