hunt-ntlm-info

Hunt NTLM/Negotiate information disclosure on internet-reachable IIS/SharePoint/Exchange. Anonymous NTLM Type-2 challenge capture leaks NetBIOS domain, internal DNS forest, computer name, AD timestamp via AV_PAIRS structure. Default Windows-installer hostnames (WIN-XXXXXXXXXXX pattern) signal lazy provisioning. Use when target advertises `WWW-Authenticate: NTLM` or `Negotiate` headers anonymously.

Quality

89%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

85%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced hunting playbook with copy-paste tooling and an explicit validation gate. Its weaknesses are length in the narrative example/root-cause sections and a monolithic structure with no reference-file split for a skill of this size.

Suggestions

Move the 'Real Impact Examples' and 'Common Root Causes' sections into separate reference files (e.g. examples.md, root-causes.md) and link to them one level deep, keeping SKILL.md as a tight overview.

Trim prose in 'Crown Jewel Targets' and 'Common Root Causes' to bullet essentials; the signal/cause detail can be shortened without losing operational value.

Add an explicit error-recovery loop for the keep-alive capture (e.g., 'if no Type-2 received, confirm Connection: keep-alive and retry on a raw socket') to strengthen the feedback loop already hinted in step 3.

Dimension	Reasoning	Score
Conciseness	Mostly efficient and assumes Claude's competence (NTLMSSP/AV_PAIRS/MS-NLMP referenced without basics explained), but the 'Real Impact Examples' narratives and six prose 'Common Root Causes' items add length that could be trimmed without losing operational value.	4 / 5
Actionability	Fully executable guidance — a copy-paste curl probe, a complete Burp HTTP/1.1 request, and a complete Python raw-socket + AV_PAIR decoder with byte offsets and AvId semantics covering the common cases.	5 / 5
Workflow Clarity	Eight clearly sequenced hunting steps plus an explicit 'Gate 0 Validation' checklist (what can the attacker do right now, does the program accept info-disclosure, reproducible in <5 min) with severity-tier mapping as a checkpoint.	5 / 5
Progressive Disclosure	Well-sectioned but monolithic: at ~271 lines with no bundle files, content that could live in separate references (Real Impact Examples, Common Root Causes, Bypass Techniques) is all inlined in SKILL.md with no one-level-deep reference links.	3 / 5
	Total	17 / 20 Passed

Description

95%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description with concrete capabilities, comprehensive natural trigger terms, and an explicit 'Use when...' clause tied to observable WWW-Authenticate headers. Only minor specificity room remains since it emphasizes leaked fields over enumerated actions.

Dimension	Reasoning	Score
Specificity	Names the domain ('Hunt NTLM/Negotiate information disclosure on internet-reachable IIS/SharePoint/Exchange') and concrete capture/decode actions with specific leaked fields (NetBIOS domain, DNS forest, computer name, AD timestamp via AV_PAIRS), but leans on describing leak contents rather than enumerating many distinct verbs, leaving minor coverage gaps.	4 / 5
Completeness	Explicitly answers both what ('Hunt NTLM/Negotiate information disclosure... leaks NetBIOS domain, internal DNS forest...') and when ('Use when target advertises WWW-Authenticate: NTLM or Negotiate headers anonymously') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Comprehensive natural trigger terms for the domain — 'NTLM', 'Negotiate', 'IIS', 'SharePoint', 'Exchange', and the literal 'WWW-Authenticate: NTLM or Negotiate headers' phrase a user would say when needing this skill.	5 / 5
Distinctiveness Conflict Risk	Clear niche — anonymous NTLM Type-2 AV_PAIR disclosure on internet-reachable IIS/SharePoint/Exchange — with distinct header-based triggers that minimize overlap with other hunting skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/hunt-ntlm-info/SKILL.md
Commit: d4b54e1

Reviewed: 12 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.