exchange-owa-attack

1# Exchange/OWA Attack Skill
2 
3Exchange Outlook Web Access reconnaissance covering endpoint mapping, NTLM
4Type-2 metadata, authentication controls, and version evidence. Password or
5lockout testing requires explicit authorization and approved identities.
6 
7## When to Use
8 
9- Target has `owa.`, `mail.`, `webmail.`, `exchange.`, or `autodiscover.` subdomains.
10- crt.sh reveals Exchange-related SAN names (`mail.domain.com`, `autodiscover.domain.com`).
11- Port 443 returns NTLM `WWW-Authenticate: Negotiate` or `WWW-Authenticate: NTLM`.
12- After `subdomain-enumeration` discovers mail-related hosts.
13- After `port-service-discovery` finds HTTPS on port 443 with Exchange fingerprints.
14 
15## Prerequisites
16 
17- `terminal` with curl, python3.
18- Target Exchange/OWA URL.
19- For password spray: list of usernames (from recon) and password candidates.
20 
21## How to Run
22 
23```bash
24# Quick Exchange detection
25curl --max-time 30 --connect-timeout 10 -skI "https://TARGET/owa/" | grep -iE "x-owa-version|x-feserver|exchange|microsoft"
26 
27# NTLM challenge capture (AD domain leak)
28curl --max-time 30 --connect-timeout 10 -skI "https://TARGET/owa/" -H "Authorization: Negotiate TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw==" | grep -i "www-authenticate"
29```
30 
31## Quick Reference
32 
33| Technique | What It Reveals | Severity |
34|-----------|---------------|---------|
35| NTLM Type-2 decode | AD domain, NetBIOS name, computer name, AD timestamp | High |
36…