ntlmscout decodes unauthenticated NTLM Type-2 challenges from HTTP, SMB, MSSQL, LDAP and more to extract Active Directory detail during authorized external assessments.

ntlmscout is a single-file Python reconnaissance tool built around a simple but frequently underappreciated observation: an unauthenticated NTLM negotiation leaks a surprising amount of internal Active Directory detail before any credential is ever transmitted. The tool sends an NTLM Type-1 NEGOTIATE message across a wide range of transports, captures the Type-2 CHALLENGE the server returns, and fully decodes it. What makes it notable is breadth — it covers HTTP(S) with endpoint discovery, SMB2/3, MSSQL/TDS, SMTP, IMAP, POP3, NNTP, LDAP(S), and RDP/CredSSP(NLA) from one binary, where most prior art specialized in one or two protocols.

The implementation philosophy is refreshingly austere: pure Python standard library, no dependencies, Python 3.7+, single file. In a field where tooling often drags in heavyweight pip dependency trees, this means deployment on a clean assessment box is a git clone and nothing else — no pip install, no virtualenv. That constraint also implies the NTLMSSP/SPNEGO parsing is hand-rolled rather than delegated to pyspnego or impacket, which the README acknowledges directly in its credits section as reference implementations the parser was modeled on.

The depth of the Type-2 decode is where the tool earns its keep. Beyond the obvious NetBIOS host and domain names, it extracts DNS host and domain, the AD forest name, the OS build number mapped to a friendly Windows version with client-versus-server disambiguation, the server clock and computed skew, the SPN, MachineID, channel bindings, and a full negotiate-flag breakdown. For an operator, the clock skew alone matters — it feeds later Kerberos planning — while the OS build tells you whether you are looking at a legacy box worth closer inspection.

Critically, the tool interprets rather than dumps. The README is explicit that a host is only classified as a Domain Controller when a DC-specific service actually answers, giving an honest member-versus-DC distinction instead of the heuristic guesswork common in quick scanners. It also produces a security-posture read covering SMB and LDAP signing, Extended Protection for Authentication and channel binding, and whether the challenge advertises weak NTLMv1/LM crypto — effectively turning a recon pass into a misconfiguration survey.

One of the more interesting design decisions is the handling of internal IP recovery. The README frames this as the one thing NTLM itself cannot give you, and compensates with adjacent unauthenticated disclosures: the ancient IIS Host-header leak (CVE-2000-0649), WebDAV PROPFIND, the RPC IOXIDResolver::ServerAlive2 technique against TCP 135, and IP SANs harvested from TLS and RDP certificates. On top of that it grabs Exchange headers like X-FEServer and X-CalculatedBETarget, plus anonymous LDAP rootDSE enrichment covering naming contexts, dnsHostName, and AD functional levels.

Performance is addressed with a port-liveness gate: every probe on a closed port is skipped so filtered hosts do not generate a wall of timeouts. Against a /24 this matters a great deal, since a naive per-protocol timeout matrix would dominate runtime. The full sweep is the default, with --no-discover to skip the HTTP path wordlist and --no-internal-ip to skip the certificate, OXID, and IIS checks when you want a leaner pass.

The output side is clearly built by someone who has had to write reports. Alongside a grouped per-host on-screen summary, it emits JSON, NDJSON, CSV, and a NetExec-style hosts file suitable for chaining directly into post-recon tooling. The README also notes output files are written with owner-only permissions — a small operational-hygiene touch that suggests the author has considered artifact handling on shared infrastructure. A --proxy flag routes everything through Burp-style CONNECT proxies, which is how you would normally pair it with interception for verification.

The optional spray mode deserves careful discussion. It is opt-in and deliberately hardwired to password-spray ordering — one password across every account per round, so no individual account sees more than one attempt per cycle. The README instructs the operator to set --delay to the target's lockout observation window and to confirm the lockout policy before running. It also separates valid, cleanly-rejected, and inconclusive results, which addresses a real problem: a broken authentication oracle that reports everything as inconclusive rather than silently producing false negatives. This mode is strictly for systems you are contractually authorized to test.

The lineage the README traces is unusually thorough and useful context for evaluating the tool. It credits NTLMRecon for HTTP endpoint discovery, ntlmscan and lyncsmash for OWA/Lync/ADFS path enumeration, ntlm_challenger for the challenge parser structure, the nmap *-ntlm-info NSE scripts for per-protocol Type-2 coaxing recipes, NetExec/CrackMapExec for banner and role-detection patterns, and MailSniper for the spray design. Protocol behavior is grounded in Microsoft's MS-NLMP open specification. This reads as a deliberate consolidation project — one tool unifying a decade of scattered technique.

For defenders, the value is equally direct. Running ntlmscout against your own perimeter shows exactly what an anonymous internet scanner can learn: internal hostnames, domain and forest names, OS builds, and internal RFC1918 addresses via paths you may not realize are still leaking, like CVE-2000-0649 — a vulnerability with a 25-year-old CVE number that still bites. Each finding it returns maps to a specific remediation: disabling NTLM where possible, enforcing channel binding and EPA, enabling SMB/LDAP signing, and suppressing the internal-IP disclosure vectors.

With 32 stars, an MIT license, and a main branch on GitHub, this is a young project rather than an established standard, but the README quality, dependency-free design, and honest acknowledgment of what the tool can and cannot conclude suggest a maintainer thinking like an operator. Invocation is straightforward: python3 ntlmscout.py 203.0.113.10 for a full sweep of a single host, or python3 ntlmscout.py -I targets.txt --json results.json for a list with machine-readable output. For authorized external assessments and perimeter audits, it consolidates a workflow that previously required half a dozen separate tools into one clean pass.

Educational analysis for authorized security professionals. Use only in controlled, authorized environments.