Package: ntlmrecon
NTLMReconA fast and flexible NTLM reconnaissance tool without external dependencies. Useful to find out information about NTLM endpoints when working with a large set of potential IP addresses and domains.NTLMRecon is built with flexibilty in mind. Need to run recon on a single URL, an IP address, an entire CIDR range or combination of all of it all put in a single input file? No problem! NTLMRecon got you covered. Read on.DemoOverviewNTLMRecon looks for NTLM enabled web endpoints, sends a fake authentication request and enumerates the following information from the NTLMSSP response:AD Domain NameServer nameDNS Domain NameFQDNParent DNS DomainSince NTLMRecon leverages a python implementation of NTLMSSP, it eliminates the overhead of running Nmap NSEhttp-ntlm-infofor every successful discovery.On every successful discovery of a NTLM enabled web endpoint, the tool enumerates and saves information about the domain as follows to a CSV file :URLDomain NameServer NameDNS Domain NameFQDNDNS Domainhttps://contoso.com/EWS/XCORPEXCHANGE01xcorp.contoso.netEXCHANGE01.xcorp.contoso.netcontoso.netInstallationBlackArchNTLMRecon is already packaged for BlackArch and can be installed by runningpacman -S ntlmreconArchIf you're on Arch Linux or any Arch linux based distribution, you can grab the latest build from theArch User Repository.Generic InstallationClone the repository             :git clone https://github.com/sachinkamath/ntlmrecon/RECOMMENDED - Install virtualenv :pip install virtualenvStart a new virtual environment  :virtualenv venvand activate it withsource venv/bin/activateRun the setup file               :python setup.py installRun ntlmrecon                    :ntlmrecon --helpUsage_   _ _____ _     ___  _________                     
        | \ | |_   _| |    |  \/  || ___ \                    
        |  \| | | | | |    | .  . || |_/ /___  ___ ___  _ __  
        | . ` | | | | |    | |\/| ||    // _ \/ __/ _ \| '_ \ 
        | |\  | | | | |____| |  | || |\ \  __/ (_| (_) | | | |
        \_| \_/ \_/ \_____/\_|  |_/\_| \_\___|\___\___/|_| |_|

             v.0.2 beta - Y'all still exposing NTLM endpoints?

usage: ntlmrecon [-h] [--input INPUT | --infile INFILE] [--wordlist WORDLIST]
                 [--threads THREADS] [--output-type] --outfile OUTFILE
                 [--random-user-agent] [--force-all] [--shuffle] [-f]

optional arguments:
  -h, --help           show this help message and exit
  --input INPUT        Pass input as an IP address, URL or CIDR to enumerate
                       NTLM endpoints
  --infile INFILE      Pass input from a local file
  --wordlist WORDLIST  Override the internal wordlist with a custom wordlist
  --threads THREADS    Set number of threads (Default: 10)
  --output-type, -o    Set output type. JSON (TODO) and CSV supported
                       (Default: CSV)
  --outfile OUTFILE    Set output file name (Default: ntlmrecon.csv)
  --random-user-agent  TODO: Randomize user agents when sending requests
                       (Default: False)
  --force-all          Force enumerate all endpoints even if a valid endpoint
                       is found for a URL (Default : False)
  --shuffle            Break order of the input files
  -f, --force          Force replace filesExample UsageRecon on a single URL$ ntlmrecon --input https://mail.contoso.com --outfile ntlmrecon.csvRecon on a CIDR range or IP address$ ntlmrecon --input 192.168.1.1/24 --outfile ntlmrecon-ranges.csvRecon on an input fileThe tool automatically detects the type of input per line and gives you results automatically. CIDR ranges are expanded automatically even when read from a text file.Input file can be something as mixed up as :mail.contoso.com
CONTOSOHOSTNAME
10.0.13.2/28
192.168.222.1/24
https://mail.contoso.comTo run recon with an input file, just run :$ ntlmrecon --infile /path/to/input/file --outfile ntlmrecon-fromfile.csvAcknowledgements@nyxgeekfor the awesome wordlist inlyncsmashrepository.FeedbackIf you'd like to see a feature added into the tool or something doesn't work for you, please open a newissue.