hunt-ntlm-info

Hunt NTLM/Negotiate information disclosure on internet-reachable IIS/SharePoint/Exchange. Anonymous NTLM Type-2 challenge capture leaks NetBIOS domain, internal DNS forest, computer name, AD timestamp via AV_PAIRS structure. Default Windows-installer hostnames (WIN-XXXXXXXXXXX pattern) signal lazy provisioning. Use when target advertises `WWW-Authenticate: NTLM` or `Negotiate` headers anonymously.

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Highly actionable with executable code and a clear, validated hunting workflow. Conciseness and progressive disclosure are weaker: the body is a long monolith that re-explains known protocol behavior and keeps all detail inline rather than splitting it into referenced bundle files.

Suggestions

Trim or move the repeated NTLMSSP byte-layout and severity-tier explanations (duplicated across methodology, root causes, and Gate 0) into a single reference file to reduce token overhead.

Split the full Python decoder and the 'Related Skills & Chains' narratives into references/ files (e.g. payloads.md, chains.md) and link them one level deep from SKILL.md.

Move the scenario impact examples and Root Causes detail into a separate reference doc, keeping SKILL.md as a lean overview with the methodology and validation gate.

Dimension	Reasoning	Score
Conciseness	Mostly efficient and actionable, but sections re-explain NTLMSSP protocol behavior and repeat the severity-tier logic multiple times (methodology, root causes, Gate 0, impact examples), adding padding beyond what Claude already knows.	2 / 3
Actionability	Provides copy-paste-ready, executable artifacts: the exact Type-1 base64 string, a working curl probe, a Burp request, and a complete Python raw-socket AV_PAIR decoder, all directly runnable.	3 / 3
Workflow Clarity	The step-by-step methodology is a clearly sequenced 8-step process with explicit parsing/decoding checkpoints and a 'Gate 0 Validation' checklist with decision rules for severity and reportability, giving strong validation feedback loops.	3 / 3
Progressive Disclosure	No bundle files (references/scripts/assets) exist, yet the body is a ~270-line monolith holding protocol byte-layouts, full code, root causes, scenarios, and chain narratives inline that could be split into reference files; organization is sectioned but nothing is offloaded to a one-level-deep file.	2 / 3
	Total	10 / 12 Passed

Description

85%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description with concrete actions and an explicit 'Use when' trigger covering both what and when. Slight ding on trigger term quality because the phrasing is jargon-heavy rather than natural user language.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions (hunt NTLM/Negotiate info disclosure, anonymous Type-2 challenge capture, leak of NetBIOS domain/internal DNS forest/computer name/AD timestamp) on specific targets (IIS/SharePoint/Exchange), matching the 'multiple specific concrete actions' anchor.	3 / 3
Completeness	Clearly answers 'what' (capture NTLM Type-2 challenge to leak internal domain/forest/host/timestamp info) AND 'when' via the explicit 'Use when target advertises `WWW-Authenticate: NTLM` or `Negotiate` headers anonymously' clause, satisfying the explicit-trigger anchor.	3 / 3
Trigger Term Quality	Includes some natural terms a user might say (NTLM, Exchange, SharePoint) but leans on technical jargon (AV_PAIRS structure, Negotiate headers) that a typical user would not naturally say, missing common variations.	2 / 3
Distinctiveness Conflict Risk	The NTLM Type-2 / WWW-Authenticate NTLM/Negotiate trigger is a clear, narrow niche with distinct headers unlikely to overlap with or trigger other skills.	3 / 3
	Total	11 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-ntlm-info/SKILL.md
Commit: 6b9c96e

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.