# WinRM Endpoint Probing

- **URL:** https://hackindex.io/services/winrm/enumeration/winrm-endpoint-probing
- **Path:** WinRM > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/winrm/enumeration.md)
- **Published:** 2026-01-04
- **Updated:** 2026-05-15

WinRM endpoint probing confirms the service is present, identifies what authentication methods are advertised, determines whether the listener is native WinRM or fronted by IIS, and extracts hostname and certificate information. This is the first step before any credential validation or vulnerability checks.

## WinRM Endpoint Probing via Port and Service Detection

```bash
nmap -Pn -sV -p 5985,5986 $TARGET_IP
# 5985/tcp open  http    Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
# 5986/tcp open  ssl/http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
```

`Microsoft HTTPAPI/2.0` on either port confirms a WinRM listener is active. Interpret the port combination:

- Only 5985 open: WinRM running over plain HTTP
- Only 5986 open: HTTPS only
- Both open: HTTP and HTTPS listeners running in parallel

For subnet-wide discovery of hosts with WinRM open:

```bash
nmap -Pn -p 5985,5986 --open $TARGET_IP/24
```

## Probe the WSMan Endpoint

WinRM listens on `/wsman` by default. A direct HTTP request returns the authentication methods and confirms the endpoint is active:

```bash
curl -s -D - -o /dev/null http://$TARGET_IP:5985/wsman
curl -sk -D - -o /dev/null https://$TARGET_IP:5986/wsman
# HTTP/1.1 405 Method Not Allowed
# Server: Microsoft-HTTPAPI/2.0
# WWW-Authenticate: Negotiate
# WWW-Authenticate: NTLM
# Date: Mon, 10 Mar 2025 12:34:56 GMT
```

A `405 Method Not Allowed` or `401 Unauthorized` with `Microsoft-HTTPAPI/2.0` confirms an active WSMan endpoint. A `404` on `/wsman` means either the listener is not active on that port or the path differs. Try `/` to check for a redirect:

```bash
curl -s -D - -o /dev/null http://$TARGET_IP:5985/
```

## Read the Authentication Methods

The `WWW-Authenticate` header lists every method the service accepts. Pull only the relevant headers:

```bash
curl -s -D - -o /dev/null http://$TARGET_IP:5985/wsman | grep -i "WWW-Authenticate\|Server:"
```

What each value indicates:

`Negotiate`: Kerberos is available. Tooling falls back to NTLM automatically when Kerberos negotiation fails.

`NTLM`: challenge-response over NTLM works. The NTLM challenge also leaks domain name and computer name without completing authentication, covered in [WinRM Service Discovery with NTLM Info](https://hackindex.io/services/winrm/enumeration/winrm-service-discovery-and-ntlm-info).

`Basic`: credentials are base64-encoded. On 5985 over plain HTTP, Basic authentication exposes credentials on the wire. This is a vulnerability finding covered in [WinRM Basic Auth Detection](https://hackindex.io/services/winrm/vulnerability-discovery/winrm-basic-auth-detection).

No `WWW-Authenticate` header: either not a WinRM endpoint, or a proxy is stripping the challenge.

## Confirm Native WinRM vs IIS

The `Server` header distinguishes native WinRM from an IIS-hosted configuration:

```bash
curl -s -D - -o /dev/null http://$TARGET_IP:5985/wsman | grep -i "^Server:"
```

`Microsoft-HTTPAPI/2.0` is the native WinRM HTTP listener. `Microsoft-IIS/10.0` or similar means WinRM is hosted behind IIS, which may produce different path behaviour and additional auth layers.

## Nmap HTTP and Method Scripts

Nmap's HTTP scripts can confirm the endpoint and check what HTTP methods the service accepts:

```bash
nmap -Pn -p 5985,5986 --script http-methods,http-title $TARGET_IP
```

This is useful when curl returns ambiguous responses: `http-title` sometimes clarifies whether you are hitting a WinRM endpoint or an unrelated web service on the same port.

## TLS Certificate Names on 5986

The certificate on port 5986 reveals the intended hostname and often exposes internal FQDNs in the Subject Alternative Names:

```bash
nmap -Pn -p 5986 --script ssl-cert $TARGET_IP
# | ssl-cert:
# |   Subject: commonName=WORKSTATION01.corp.local
# |   Subject Alternative Name: DNS:WORKSTATION01, DNS:WORKSTATION01.corp.local
```

Use the CN or SAN value as the hostname in tools that validate certificate names. This also gives the internal domain name without any Active Directory queries.

To check via openssl:

```bash
openssl s_client -connect $TARGET_IP:5986 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName
```

## Redirect Detection

Some environments redirect 5985 to 5986 or to a specific FQDN. Follow redirects to detect this:

```bash
curl -s -D - -o /dev/null -L http://$TARGET_IP:5985/wsman | grep -i "Location:\|HTTP/"
```

If a redirect points to an internal hostname, that name must resolve correctly for authentication to succeed. Add it temporarily:

```bash
echo "$TARGET_IP $DOMAIN" | sudo tee -a /etc/hosts
```

Once auth methods are identified, validate credentials with [WinRM Credential Validation](https://hackindex.io/services/winrm/enumeration/winrm-credential-validation). For password attacks against the endpoint, see [WinRM Brute Force and Password Spray](https://hackindex.io/services/winrm/exploitation/brute-force-password-spray).

## References

- [ ssl-cert NSE Script](https://nmap.org/nsedoc/scripts/ssl-cert.html) - Certificate subject and SAN extraction for HTTPS listeners
- [http-methods NSE Script](https://nmap.org/nsedoc/scripts/http-methods.html) - HTTP method enumeration for web-based services including WinRM
- [WinRM Installation and Configuration](https://learn.microsoft.com/en-us/windows/win32/winrm/installation-and-configuration-for-windows-remote-management) - Certificate subject/SAN extraction for HTTPS listeners