[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6P64VHB0TZCNFBR87H8FFMS":3,"skill-same:01M6P64VHB0TZCNFBR87H8FFMS":69},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":32,"commitSha":50,"skillDirectory":51,"forksCount":13,"repositoryHtmlUrl":52,"repositoryHomepageUrl":6,"ownerHtmlUrl":53,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":54,"install":55,"resources":68},"01M6P64VHB0TZCNFBR87H8FFMS","hunt-ntlm-info",null,"Hunt NTLM\u002FNegotiate information disclosure on internet-reachable IIS\u002FSharePoint\u002FExchange.","duc-duy-1612\u002FOnline-Delivery-Systems-Web","duc-duy-1612","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F192231384?v=4","01M6NSDKQQDKVTHZ8DZMZ1VYY6","01M6NSDKW8DDVTQHBT1HBDDJPT",0,"MIT","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fhunt-ntlm-info\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"hunt ntlm info","hunt","info","scope","for","internet","information","relevant","sharepoint","offensive","negotiate","scripts","testing","commands","main","community","only","Tools","license","security","2026-11-10 10:12:30",false,"---\nname: hunt-ntlm-info\ndescription: Hunt NTLM\u002FNegotiate information disclosure on internet-reachable IIS\u002FSharePoint\u002FExchange.\ncategory: security\nrisk: offensive\nsource: https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\nsource_repo: elementalsouls\u002FClaude-BugHunter\nsource_type: community\ndate_added: '2026-09-20'\nlicense: MIT\nlicense_source: https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\u002Fblob\u002Fmain\u002FLICENSE\ncompatibility: Requires explicit written authorization for a target scope plus the\n  relevant testing tools for this technique. Docs-only; helper scripts and commands\n  not bundled.\nsources: github, authorized-engagement\nreport_count: 1\n---\n> **⚠️ AUTHORIZED USE ONLY**\n> This skill is for educational purposes or authorized security assessments only.\n> You must have explicit, written permission from the system owner before using this tool.\n> Misuse of this tool is illegal and strictly prohibited.\n\n> **Mandatory confirmation gate**\n> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:\n> 1. Ask the user to state the exact target URL, IP, account, or resource.\n> 2. Ask the user to confirm written authorization and the permitted scope.\n> 3. Show the exact command(s) and explain their expected effect.\n> 4. Wait for explicit confirmation in the current conversation.\n>\n> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.\n\n## Crown Jewel Targets\n\nNTLM info disclosure is a **Medium-severity finding when chained to context** — the leak itself is intentional protocol behavior (RFC-compliant NTLMSSP challenge), but on internet-exposed enterprise infrastructure it provides exact reconnaissance for the next stage of an attack. Highest-value targets:\n\n- **Internet-reachable IIS \u002F SharePoint \u002F Exchange \u002F OWA** with dual-auth (Forms + NTLM, or NTLM + Kerberos)\n- **Citrix NetScaler \u002F VMware Horizon View** internet-facing gateways with NTLM-backed AD auth\n- **Lync \u002F Skype for Business \u002F Teams On-Prem** edge servers\n- **WSUS \u002F Windows Update Services** with NTLM-protected admin paths\n- **CIFS-style fileshare proxies** (HCL Sametime, IBM Notes Domino) that proxy NTLM\n- **Legacy SharePoint farms** that left NTLM enabled on the public-zone IIS binding\n\n**What makes this pay:**\n- Internal AD domain disclosure (parent-forest mapping, e.g. `customer.parent-corp.example` → tenant inside corporate-AD tree)\n- Default-Windows-hostname disclosure (`WIN-XXXXXXXXXXX` pattern signals rushed provisioning → likely default service-account passwords)\n- Timestamp leak (used in NTLMv2 hash cracking acceleration)\n- Direct attack-map enrichment for credential spraying combined with `hunt-auth-bypass` Legacy-Protocol Matrix\n\n---\n\n## Attack Surface Signals\n\n**Response headers signaling NTLM availability:**\n```\nWWW-Authenticate: NTLM\nWWW-Authenticate: Negotiate\nWWW-Authenticate: NTLM, Negotiate\nWWW-Authenticate: Negotiate, NTLM\n```\n\n**URL patterns where NTLM is commonly exposed:**\n```\n\u002F_api\u002Fweb\u002FCurrentUser                  (SharePoint REST)\n\u002F_vti_bin\u002F*.asmx                       (SharePoint legacy SOAP)\n\u002FEWS\u002FExchange.asmx                     (Exchange Web Services)\n\u002FAutodiscover\u002FAutodiscover.xml         (Exchange autodiscover)\n\u002Fowa\u002F                                  (Outlook Web App)\n\u002FMicrosoft-Server-ActiveSync           (ActiveSync)\n\u002FPowerShell                            (Exchange Mgmt Shell over HTTPS)\n\u002Fapi\u002Fv3\u002F                               (TeamCity, Atlassian)\n\u002Fwsus\u002F                                 (Windows Server Update Services)\n\u002Fmanager\u002Fhtml                          (some Tomcat behind IIS)\n\u002Fiisstart.htm                          (default IIS, sometimes reveals NTLM upstream)\n```\n\n**Tech-stack signals:**\n- IIS on the public internet (almost always NTLM-capable, even if Forms is the front)\n- SharePoint Web Front End (almost always dual-auth Forms + NTLM)\n- Exchange edge transport\n- Server header `Microsoft-HTTPAPI\u002F2.0`, `Microsoft-IIS\u002F*`, `IIS\u002F*`\n\n---\n\n## Step-by-Step Hunting Methodology\n\n1. **Probe every anonymous endpoint for `WWW-Authenticate: NTLM`.** Send a vanilla GET and inspect response headers. If NTLM is offered, proceed.\n\n2. **Send a valid NTLMSSP Type-1 message anonymously.** The Type-1 base64 below requests NetBIOS-domain and Workstation info from the server:\n   ```\n   Authorization: NTLM TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw==\n   ```\n   This is the standard test Type-1 with negotiate flags `NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_NEGOTIATE_OEM | NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_NEGOTIATE_KEY_EXCH | NTLMSSP_NEGOTIATE_56 | NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_TARGET_INFO`. The `OS Version` field (`06 01 B1 1D 00 00 00 0F`) is Windows 7 build 7601 — accepted by virtually every NTLM responder.\n\n3. **Use a keep-alive raw socket, not Python requests \u002F curl one-shot.** Most HTTP libraries close the connection between the Type-1 send and Type-2 reception. Use one of:\n   - Burp Repeater with `Connection: keep-alive` set explicitly\n   - Burp `mcp__burp__send_http1_request` (handles keep-alive natively)\n   - Python raw `socket` + `ssl.wrap_socket` (see Payload section)\n\n4. **Parse the Type-2 challenge from the `WWW-Authenticate: NTLM \u003Cbase64>` response header.** Base64-decode the value. The structure is NTLMSSP per MS-NLMP:\n   - Bytes 0-7: literal `NTLMSSP\\0`\n   - Bytes 8-11: MessageType = `\\x02\\x00\\x00\\x00`\n   - Bytes 12-19: TargetName SecurityBuffer (len, alloc, offset)\n   - Bytes 20-23: NegotiateFlags\n   - Bytes 24-31: Server Challenge (8 bytes — useful for offline cracking)\n   - Bytes 40-47: TargetInfo SecurityBuffer (len, alloc, offset)\n   - TargetInfo body: `AV_PAIRS` array of (AvId u16, AvLen u16, Value)\n\n5. **Decode the AV_PAIRS.** The AvIds you care about:\n   - `1` = NetBIOS Computer Name\n   - `2` = NetBIOS Domain Name\n   - `3` = DNS Computer Name (FQDN of the responding server)\n   - `4` = DNS Domain Name (the AD domain)\n   - `5` = DNS Tree Name (the AD forest root)\n   - `7` = Timestamp (FILETIME, useful for NTLMv2 hash relay \u002F cracking)\n   - `9` = Target Name (in newer NTLMSSP)\n\n6. **Map findings to severity tier:**\n   - Internet-exposed + default `WIN-XXXXXXXXXXX` hostname + corporate-AD-tree disclosure → **Medium**\n   - Internet-exposed + named-server hostname (`SPWEB01.corp.example`) + corporate-AD-tree → **Low-Medium**\n   - Intranet-only + any disclosure → **Informational**\n   - Combine with `hunt-auth-bypass` Legacy-Protocol Matrix findings on the same host → **upgrade the auth-bypass finding's severity** since the attacker has UPN\u002FSAM format ready\n\n7. **Check the timestamp.** If `AV[7]` returns a current FILETIME within ~5s of `Date:` header, the system clock is synced — useful intel for Kerberos golden-ticket forging (out of bug-bounty scope but red-team relevant).\n\n8. **Cross-reference with subdomain enum.** The DNS Tree name often reveals the *parent forest* — e.g. `customer.parent-corp.example` reveals the customer is a sub-domain INSIDE corporate-parent AD, not a separate tenant. This is a privacy \u002F topology-disclosure escalation that programs sometimes accept as Medium.\n\n---\n\n## Payload & Detection Patterns\n\n**Generic NTLM Type-1 anonymous probe (curl + raw socket fallback):**\n```bash\n# Most one-shot curl runs DON'T return Type-2 because the connection closes.\n# Use this as a quick probe to confirm NTLM is offered:\ncurl -sk -I -H \"Authorization: NTLM TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw==\" \\\n  \"https:\u002F\u002Ftarget.example\u002F_api\u002Fweb\u002FCurrentUser\" 2>&1 | grep -i \"WWW-Authenticate\"\n```\n\n**Burp `send_http1_request` (recommended for full Type-2 capture):**\n```\nGET \u002F_api\u002Fweb\u002FCurrentUser HTTP\u002F1.1\nHost: target.example\nAuthorization: NTLM TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw==\nConnection: keep-alive\nUser-Agent: Mozilla\u002F5.0\n\n```\n\n**Python raw socket + AV_PAIR decoder:**\n```python\nimport socket, ssl, base64, struct, re\nfrom datetime import datetime, timezone\n\nHOST = \"target.example\"\nctx = ssl.create_default_context()\nctx.check_hostname = False\nctx.verify_mode = ssl.CERT_NONE\n\ns = ctx.wrap_socket(socket.create_connection((HOST, 443)), server_hostname=HOST)\ns.sendall(\n    f\"GET \u002F_api\u002Fweb\u002FCurrentUser HTTP\u002F1.1\\r\\n\"\n    f\"Host: {HOST}\\r\\n\"\n    \"Authorization: NTLM TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw==\\r\\n\"\n    \"User-Agent: Mozilla\u002F5.0\\r\\nConnection: keep-alive\\r\\n\\r\\n\".encode()\n)\ndata = b\"\"\nwhile True:\n    chunk = s.recv(8192)\n    if not chunk: break\n    data += chunk\n    if b\"\\r\\n\\r\\n\" in data: break\n\nm = re.search(rb\"WWW-Authenticate:\\s*NTLM\\s+([A-Za-z0-9+\u002F=]{20,})\", data, re.I)\nif m:\n    b = base64.b64decode(m.group(1).decode(\"ascii\"))\n    assert b[:8] == b\"NTLMSSP\\x00\"\n    tn_len, _, tn_off = struct.unpack_from('\u003CHHI', b, 12)\n    ti_len, _, ti_off = struct.unpack_from('\u003CHHI', b, 40)\n    print(f\"TargetName: {b[tn_off:tn_off+tn_len].decode('utf-16-le', errors='ignore')!r}\")\n    av_types = {1:'NetBIOS Computer Name', 2:'NetBIOS Domain Name',\n                3:'DNS Computer Name', 4:'DNS Domain Name',\n                5:'DNS Tree Name', 7:'Timestamp', 9:'Target Name'}\n    i = 0\n    ti = b[ti_off:ti_off+ti_len]\n    while i \u003C len(ti):\n        av_id, av_len = struct.unpack_from('\u003CHH', ti, i)\n        if av_id == 0: break\n        val = ti[i+4:i+4+av_len]\n        if av_id == 7:\n            ts = struct.unpack('\u003CQ', val[:8])[0]\n            secs = (ts - 116444736000000000) \u002F 10000000\n            vs = datetime.fromtimestamp(secs, tz=timezone.utc).isoformat()\n        else:\n            vs = val.decode('utf-16-le', errors='ignore')\n        print(f\"  AV[{av_id}] {av_types.get(av_id, '?'):28s}: {vs!r}\")\n        i += 4 + av_len\n```\n\n**Burp Collaborator NOT needed** for this finding class — the data leak is in the synchronous response, not via OOB.\n\n---\n\n## Common Root Causes\n\n1. **Dual-auth IIS bindings on the public zone.** Administrators leave NTLM enabled on the public-facing IIS site even when Forms auth is the intended entry point. Internal users get SSO; external attackers get the AD topology leak.\n\n2. **Default IIS Application Pool identity left as `ApplicationPoolIdentity`.** Combined with default hostname, signals provisioning never went past first-boot.\n\n3. **Server never renamed from Windows-installer-generated hostname.** Microsoft's default `WIN-XXXXXXXXXXX` 11-character pattern is the immediate tell. Sometimes also `WORKGROUP\\WIN-...` in older boxes.\n\n4. **Sub-domain joined to corporate forest without zone-isolation.** European-integrator case: a a European importer's SharePoint test environment is a child domain inside a corporate global AD, disclosed via NTLM DNS Tree Name. The customer probably intends `customer.parent-corp.example` to be operationally separate but the NTLM Type-2 reveals the forest membership to anyone who probes.\n\n5. **IIS Extended Protection NOT enabled.** When `\u003Csystem.webServer>\u003Csecurity>\u003Cauthentication>\u003CwindowsAuthentication extendedProtection>` is `None` (the default), the NTLM challenge is sent to any anonymous client. When set to `Required`, NTLM is restricted to authenticated callers — and the AV-pair leak is mitigated.\n\n6. **No `WindowsAuthentication` removed from `applicationHost.config` for internet-exposed sites.** SharePoint Central Admin sometimes leaves this enabled even when SP zone configuration only enables Forms.\n\n---\n\n## Bypass Techniques\n\nThis skill describes a disclosure leak, not an authentication bypass. The \"bypass\" question is: *how do defenders block this AV-pair leak while still allowing legitimate NTLM auth?*\n\n| Defense | Effectiveness |\n|---|---|\n| **Disable NTLM on the public IIS binding entirely** (Forms-only) | Best — eliminates the surface |\n| **IIS Extended Protection = Required** | Restricts NTLM challenge to authenticated callers; AV-pair leak mitigated |\n| **Reverse-proxy strip `WWW-Authenticate` from anonymous responses** | Sometimes works but breaks legitimate clients |\n| **Rate-limit the Type-1 → Type-2 endpoint** | Doesn't prevent disclosure, only slows enumeration |\n| **Rename the Windows host from `WIN-XXXXXXXXXXX`** | Removes the \"lazy provisioning\" tell; doesn't stop the leak |\n| **Move the SP\u002FExchange farm to a child AD with no cross-trust to corporate** | Mitigates the *forest disclosure*; doesn't stop the leak |\n\nFor the attacker: there's no \"bypass\" needed — the leak is the finding.\n\n---\n\n## Gate 0 Validation\n\nBefore writing the report, confirm:\n\n1. **What can the attacker do RIGHT NOW with this disclosure?**\n   - Internet-exposed + default hostname + corporate forest disclosed → **Medium**: attacker has UPN format for `hunt-auth-bypass` matrix probes, plus knows server has likely-default service accounts.\n   - Intranet-only or only NetBIOS name → **Informational**.\n\n2. **Does the program accept information-disclosure findings without a chained impact?**\n   - Many programs (Microsoft, large enterprise VDPs) DO accept this when the leaked info includes internal AD topology.\n   - Many programs (Shopify, GitHub) reject info disclosure without a chained impact.\n   - Read the program scope before submitting; if borderline, chain with a Tier-A finding from `hunt-auth-bypass`.\n\n3. **Can you reproduce in \u003C5 minutes from a fresh shell?**\n   - The Python snippet above is the canonical reproduction. Include it verbatim in the report.\n\n---\n\n## Real Impact Examples\n\n### Scenario A — Enterprise SharePoint inside parent corporate AD\n\nTarget: `https:\u002F\u002Ftarget-portal.example\u002F` — a enterprise dealer portal (test mirror) operated by a system integrator.\n\nSending the anonymous Type-1 message to `\u002F_api\u002Fweb\u002FCurrentUser` returned a Type-2 challenge whose AV_PAIRS decoded to:\n\n```\nNetBIOS Domain Name:    \u003CCustomerName>\nNetBIOS Computer Name:  WIN-XXXXXXXXXXX\nDNS Domain Name:        customer.parent-corp.example\nDNS Computer Name:      WIN-XXXXXXXXXXX.customer.parent-corp.example\nDNS Tree Name:          customer.parent-corp.example\nTimestamp:              2026-05-13T15:55:37.922Z\n```\n\nThree escalation paths:\n1. **Default Windows-installer hostname (`WIN-XXXXXXXXXXX`)** — server was never renamed after OS install; strong signal of lazy provisioning. Likely default service-account passwords on the SQL backend, default WSUS config, etc.\n2. **Sub-domain inside corporate-parent AD (`customer.parent-corp.example`)** — the customer is a child domain inside \u003CParentCorp>'s global Active Directory. A compromise of this test farm has potential cross-trust to corporate-parent.\n3. **UPN format known** — combined with `hunt-auth-bypass`'s discovery of an anonymous brute-force endpoint on `\u002F_vti_bin\u002FAuthentication.asmx`, the attacker has both the credential format (`firstname.lastname@customer.parent-corp.example` or `\u003CCustomerName>\\firstname.lastname`) and the unlimited submission endpoint.\n\nReported severity: **Medium**, with a note that the chain with the Authentication.asmx anonymous brute-force makes the combined attack Critical.\n\n### Scenario B — Exchange edge with NTLM-protected EWS\n\nTarget: `https:\u002F\u002Fmail.example.com\u002FEWS\u002FExchange.asmx`. Type-1 probe returns Type-2 with DNS Tree Name `corp.example.com` and DNS Computer Name `MAIL01.corp.example.com`. Confirms the Exchange edge is domain-joined to corporate AD (rather than running in a DMZ-isolated AD). For an attacker with the matching `hunt-mfa-bypass` \u002F `hunt-auth-bypass` chain, the leaked UPN format and server-name format accelerate credential spraying by removing the recon step. Reported severity: Low-Medium depending on program.\n\n### Scenario C — Intranet-only intentional leak (not a finding)\n\nTarget: `https:\u002F\u002Fintranet.corp.example` (clearly internal, behind VPN). Type-1 returns full AV-pair set. Not reportable — this is intended NTLM behavior on intranet, and the disclosure is to authenticated VPN users who already see the same data via `nltest \u002Fdsgetdc:corp.example.com`. Recognize and drop.\n\n---\n\n## Related Skills & Chains\n\n- **`hunt-sharepoint`** — SharePoint farms emit anonymous Type-2 challenges on `\u002F_vti_bin\u002F` by default; this is one of the most reliable ways to get internal AD topology. Chain primitive: SharePoint discovered → NTLM Type-2 capture on `\u002F_vti_bin\u002FLists.asmx` → `hunt-ntlm-info` AV_PAIR decode → internal forest name → `m365-entra-attack` ROPC spray on Entra tenant tied to that forest.\n- **`m365-entra-attack`** — Leaked NetBIOS domain + UPN suffix is the missing piece for a credible password spray. Chain primitive: NTLM Type-2 yields `corp.example.com` DNS tree → cross-reference Entra tenant via `https:\u002F\u002Flogin.microsoftonline.com\u002Fcorp.example.com\u002F.well-known\u002Fopenid-configuration` → `m365-entra-attack` AADSTS error-differential username enumeration on resolved tenant.\n- **`hunt-aspnet`** — IIS sites running ASP.NET frequently expose NTLM on management paths. Chain primitive: NTLM Type-2 on `\u002Fowa\u002F`, `\u002Fecp\u002F`, `\u002Frpc\u002F`, `\u002Faspnet_client\u002F` → confirm IIS + ASP.NET version → `hunt-aspnet` ViewState \u002F `.axd` enumeration on same host.\n- **`offensive-osint`** — The hostname pattern `WIN-XXXXXXXXXXX` signals lazy provisioning and predicts other weak hygiene. Chain primitive: NTLM Type-2 returns default-installer hostname → flag as low-maturity environment → `offensive-osint` deep recon (cert transparency, GitHub leakage, breach corpus correlation) is high-yield on this org.\n- **`triage-validation`** — Most NTLM info-disclosure findings die at the 7-Question Gate on \"is this exploitable\" — pure topology disclosure is Low\u002FInformational. Chain primitive: pull every NTLM-info finding through `triage-validation` BEFORE writing it up; only report if (a) leaks UPN format that accelerates spray, or (b) leaks production hostname mapping (`redteam-report-template` for the chain-narrative).\n\n## When to Use\n\n- You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.\n- You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.\n\n## Limitations\n\n- Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.\n- Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.\n- Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.\n\n### Example\n\n```bash\n# Read-only first step; confirm scope before anything active.\ncat scope.txt  # target list from the authorized engagement brief\n```\n\n> Adapted from [elementalsouls\u002FClaude-BugHunter](https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: executable helpers, commands, engine, and research assets not bundled.\n","> **⚠️ AUTHORIZED USE ONLY**\n> This skill is for educational purposes or authorized security assessments only.\n> You must have explicit, written permission from the system owner before using this tool.\n> Misuse of this tool is illegal and strictly prohibited.\n\n> **Mandatory confirmation gate**\n> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:\n> 1. Ask the user to state the exact target URL, IP, account, or resource.\n> 2. Ask the user to confirm written authorization and the permitted scope.\n> 3. Show the exact command(s) and explain their expected effect.\n> 4. Wait for explicit confirmation in the current conversation.\n>\n> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.\n\n## Crown Jewel Targets\n\nNTLM info disclosure is a **Medium-severity finding when chained to context** — the leak itself is intentional protocol behavior (RFC-compliant NTLMSSP challenge), but on internet-exposed enterprise infrastructure it provides exact reconnaissance for the next stage of an attack. Highest-value targets:\n\n- **Internet-reachable IIS \u002F SharePoint \u002F Exchange \u002F OWA** with dual-auth (Forms + NTLM, or NTLM + Kerberos)\n- **Citrix NetScaler \u002F VMware Horizon View** internet-facing gateways with NTLM-backed AD auth\n- **Lync \u002F Skype for Business \u002F Teams On-Prem** edge servers\n- **WSUS \u002F Windows Update Services** with NTLM-protected admin paths\n- **CIFS-style fileshare proxies** (HCL Sametime, IBM Notes Domino) that proxy NTLM\n- **Legacy SharePoint farms** that left NTLM enabled on the public-zone IIS binding\n\n**What makes this pay:**\n- Internal AD domain disclosure (parent-forest mapping, e.g. `customer.parent-corp.example` → tenant inside corporate-AD tree)\n- Default-Windows-hostname disclosure (`WIN-XXXXXXXXXXX` pattern signals rushed provisioning → likely default service-account passwords)\n- Timestamp leak (used in NTLMv2 hash cracking acceleration)\n- Direct attack-map enrichment for credential spraying combined with `hunt-auth-bypass` Legacy-Protocol Matrix\n\n---\n\n## Attack Surface Signals\n\n**Response headers signaling NTLM availability:**\n```\nWWW-Authenticate: NTLM\nWWW-Authenticate: Negotiate\nWWW-Authenticate: NTLM, Negotiate\nWWW-Authenticate: Negotiate, NTLM\n```\n\n**URL patterns where NTLM is commonly exposed:**\n```\n\u002F_api\u002Fweb\u002FCurrentUser                  (SharePoint REST)\n\u002F_vti_bin\u002F*.asmx                       (SharePoint legacy SOAP)\n\u002FEWS\u002FExchange.asmx                     (Exchange Web Services)\n\u002FAutodiscover\u002FAutodiscover.xml         (Exchange autodiscover)\n\u002Fowa\u002F                                  (Outlook Web App)\n\u002FMicrosoft-Server-ActiveSync           (ActiveSync)\n\u002FPowerShell                            (Exchange Mgmt Shell over HTTPS)\n\u002Fapi\u002Fv3\u002F                               (TeamCity, Atlassian)\n\u002Fwsus\u002F                                 (Windows Server Update Services)\n\u002Fmanager\u002Fhtml                          (some Tomcat behind IIS)\n\u002Fiisstart.htm                          (default IIS, sometimes reveals NTLM upstream)\n```\n\n**Tech-stack signals:**\n- IIS on the public internet (almost always NTLM-capable, even if Forms is the front)\n- SharePoint Web Front End (almost always dual-auth Forms + NTLM)\n- Exchange edge transport\n- Server header `Microsoft-HTTPAPI\u002F2.0`, `Microsoft-IIS\u002F*`, `IIS\u002F*`\n\n---\n\n## Step-by-Step Hunting Methodology\n\n1. **Probe every anonymous endpoint for `WWW-Authenticate: NTLM`.** Send a vanilla GET and inspect response headers. If NTLM is offered, proceed.\n\n2. **Send a valid NTLMSSP Type-1 message anonymously.** The Type-1 base64 below requests NetBIOS-domain and Workstation info from the server:\n   ```\n   Authorization: NTLM TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw==\n   ```\n   This is the standard test Type-1 with negotiate flags `NTLMSSP_NEGOTIATE_UNICODE | NTLMSSP_NEGOTIATE_OEM | NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_NEGOTIATE_KEY_EXCH | NTLMSSP_NEGOTIATE_56 | NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_TARGET_INFO`. The `OS Version` field (`06 01 B1 1D 00 00 00 0F`) is Windows 7 build 7601 — accepted by virtually every NTLM responder.\n\n3. **Use a keep-alive raw socket, not Python requests \u002F curl one-shot.** Most HTTP libraries close the connection between the Type-1 send and Type-2 reception. Use one of:\n   - Burp Repeater with `Connection: keep-alive` set explicitly\n   - Burp `mcp__burp__send_http1_request` (handles keep-alive natively)\n   - Python raw `socket` + `ssl.wrap_socket` (see Payload section)\n\n4. **Parse the Type-2 challenge from the `WWW-Authenticate: NTLM \u003Cbase64>` response header.** Base64-decode the value. The structure is NTLMSSP per MS-NLMP:\n   - Bytes 0-7: literal `NTLMSSP\\0`\n   - Bytes 8-11: MessageType = `\\x02\\x00\\x00\\x00`\n   - Bytes 12-19: TargetName SecurityBuffer (len, alloc, offset)\n   - Bytes 20-23: NegotiateFlags\n   - Bytes 24-31: Server Challenge (8 bytes — useful for offline cracking)\n   - Bytes 40-47: TargetInfo SecurityBuffer (len, alloc, offset)\n   - TargetInfo body: `AV_PAIRS` array of (AvId u16, AvLen u16, Value)\n\n5. **Decode the AV_PAIRS.** The AvIds you care about:\n   - `1` = NetBIOS Computer Name\n   - `2` = NetBIOS Domain Name\n   - `3` = DNS Computer Name (FQDN of the responding server)\n   - `4` = DNS Domain Name (the AD domain)\n   - `5` = DNS Tree Name (the AD forest root)\n   - `7` = Timestamp (FILETIME, useful for NTLMv2 hash relay \u002F cracking)\n   - `9` = Target Name (in newer NTLMSSP)\n\n6. **Map findings to severity tier:**\n   - Internet-exposed + default `WIN-XXXXXXXXXXX` hostname + corporate-AD-tree disclosure → **Medium**\n   - Internet-exposed + named-server hostname (`SPWEB01.corp.example`) + corporate-AD-tree → **Low-Medium**\n   - Intranet-only + any disclosure → **Informational**\n   - Combine with `hunt-auth-bypass` Legacy-Protocol Matrix findings on the same host → **upgrade the auth-bypass finding's severity** since the attacker has UPN\u002FSAM format ready\n\n7. **Check the timestamp.** If `AV[7]` returns a current FILETIME within ~5s of `Date:` header, the system clock is synced — useful intel for Kerberos golden-ticket forging (out of bug-bounty scope but red-team relevant).\n\n8. **Cross-reference with subdomain enum.** The DNS Tree name often reveals the *parent forest* — e.g. `customer.parent-corp.example` reveals the customer is a sub-domain INSIDE corporate-parent AD, not a separate tenant. This is a privacy \u002F topology-disclosure escalation that programs sometimes accept as Medium.\n\n---\n\n## Payload & Detection Patterns\n\n**Generic NTLM Type-1 anonymous probe (curl + raw socket fallback):**\n```bash\n# Most one-shot curl runs DON'T return Type-2 because the connection closes.\n# Use this as a quick probe to confirm NTLM is offered:\ncurl -sk -I -H \"Authorization: NTLM TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw==\" \\\n  \"https:\u002F\u002Ftarget.example\u002F_api\u002Fweb\u002FCurrentUser\" 2>&1 | grep -i \"WWW-Authenticate\"\n```\n\n**Burp `send_http1_request` (recommended for full Type-2 capture):**\n```\nGET \u002F_api\u002Fweb\u002FCurrentUser HTTP\u002F1.1\nHost: target.example\nAuthorization: NTLM TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw==\nConnection: keep-alive\nUser-Agent: Mozilla\u002F5.0\n\n```\n\n**Python raw socket + AV_PAIR decoder:**\n```python\nimport socket, ssl, base64, struct, re\nfrom datetime import datetime, timezone\n\nHOST = \"target.example\"\nctx = ssl.create_default_context()\nctx.check_hostname = False\nctx.verify_mode = ssl.CERT_NONE\n\ns = ctx.wrap_socket(socket.create_connection((HOST, 443)), server_hostname=HOST)\ns.sendall(\n    f\"GET \u002F_api\u002Fweb\u002FCurrentUser HTTP\u002F1.1\\r\\n\"\n    f\"Host: {HOST}\\r\\n\"\n    \"Authorization: NTLM TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw==\\r\\n\"\n    \"User-Agent: Mozilla\u002F5.0\\r\\nConnection: keep-alive\\r\\n\\r\\n\".encode()\n)\ndata = b\"\"\nwhile True:\n    chunk = s.recv(8192)\n    if not chunk: break\n    data += chunk\n    if b\"\\r\\n\\r\\n\" in data: break\n\nm = re.search(rb\"WWW-Authenticate:\\s*NTLM\\s+([A-Za-z0-9+\u002F=]{20,})\", data, re.I)\nif m:\n    b = base64.b64decode(m.group(1).decode(\"ascii\"))\n    assert b[:8] == b\"NTLMSSP\\x00\"\n    tn_len, _, tn_off = struct.unpack_from('\u003CHHI', b, 12)\n    ti_len, _, ti_off = struct.unpack_from('\u003CHHI', b, 40)\n    print(f\"TargetName: {b[tn_off:tn_off+tn_len].decode('utf-16-le', errors='ignore')!r}\")\n    av_types = {1:'NetBIOS Computer Name', 2:'NetBIOS Domain Name',\n                3:'DNS Computer Name', 4:'DNS Domain Name',\n                5:'DNS Tree Name', 7:'Timestamp', 9:'Target Name'}\n    i = 0\n    ti = b[ti_off:ti_off+ti_len]\n    while i \u003C len(ti):\n        av_id, av_len = struct.unpack_from('\u003CHH', ti, i)\n        if av_id == 0: break\n        val = ti[i+4:i+4+av_len]\n        if av_id == 7:\n            ts = struct.unpack('\u003CQ', val[:8])[0]\n            secs = (ts - 116444736000000000) \u002F 10000000\n            vs = datetime.fromtimestamp(secs, tz=timezone.utc).isoformat()\n        else:\n            vs = val.decode('utf-16-le', errors='ignore')\n        print(f\"  AV[{av_id}] {av_types.get(av_id, '?'):28s}: {vs!r}\")\n        i += 4 + av_len\n```\n\n**Burp Collaborator NOT needed** for this finding class — the data leak is in the synchronous response, not via OOB.\n\n---\n\n## Common Root Causes\n\n1. **Dual-auth IIS bindings on the public zone.** Administrators leave NTLM enabled on the public-facing IIS site even when Forms auth is the intended entry point. Internal users get SSO; external attackers get the AD topology leak.\n\n2. **Default IIS Application Pool identity left as `ApplicationPoolIdentity`.** Combined with default hostname, signals provisioning never went past first-boot.\n\n3. **Server never renamed from Windows-installer-generated hostname.** Microsoft's default `WIN-XXXXXXXXXXX` 11-character pattern is the immediate tell. Sometimes also `WORKGROUP\\WIN-...` in older boxes.\n\n4. **Sub-domain joined to corporate forest without zone-isolation.** European-integrator case: a a European importer's SharePoint test environment is a child domain inside a corporate global AD, disclosed via NTLM DNS Tree Name. The customer probably intends `customer.parent-corp.example` to be operationally separate but the NTLM Type-2 reveals the forest membership to anyone who probes.\n\n5. **IIS Extended Protection NOT enabled.** When `\u003Csystem.webServer>\u003Csecurity>\u003Cauthentication>\u003CwindowsAuthentication extendedProtection>` is `None` (the default), the NTLM challenge is sent to any anonymous client. When set to `Required`, NTLM is restricted to authenticated callers — and the AV-pair leak is mitigated.\n\n6. **No `WindowsAuthentication` removed from `applicationHost.config` for internet-exposed sites.** SharePoint Central Admin sometimes leaves this enabled even when SP zone configuration only enables Forms.\n\n---\n\n## Bypass Techniques\n\nThis skill describes a disclosure leak, not an authentication bypass. The \"bypass\" question is: *how do defenders block this AV-pair leak while still allowing legitimate NTLM auth?*\n\n| Defense | Effectiveness |\n|---|---|\n| **Disable NTLM on the public IIS binding entirely** (Forms-only) | Best — eliminates the surface |\n| **IIS Extended Protection = Required** | Restricts NTLM challenge to authenticated callers; AV-pair leak mitigated |\n| **Reverse-proxy strip `WWW-Authenticate` from anonymous responses** | Sometimes works but breaks legitimate clients |\n| **Rate-limit the Type-1 → Type-2 endpoint** | Doesn't prevent disclosure, only slows enumeration |\n| **Rename the Windows host from `WIN-XXXXXXXXXXX`** | Removes the \"lazy provisioning\" tell; doesn't stop the leak |\n| **Move the SP\u002FExchange farm to a child AD with no cross-trust to corporate** | Mitigates the *forest disclosure*; doesn't stop the leak |\n\nFor the attacker: there's no \"bypass\" needed — the leak is the finding.\n\n---\n\n## Gate 0 Validation\n\nBefore writing the report, confirm:\n\n1. **What can the attacker do RIGHT NOW with this disclosure?**\n   - Internet-exposed + default hostname + corporate forest disclosed → **Medium**: attacker has UPN format for `hunt-auth-bypass` matrix probes, plus knows server has likely-default service accounts.\n   - Intranet-only or only NetBIOS name → **Informational**.\n\n2. **Does the program accept information-disclosure findings without a chained impact?**\n   - Many programs (Microsoft, large enterprise VDPs) DO accept this when the leaked info includes internal AD topology.\n   - Many programs (Shopify, GitHub) reject info disclosure without a chained impact.\n   - Read the program scope before submitting; if borderline, chain with a Tier-A finding from `hunt-auth-bypass`.\n\n3. **Can you reproduce in \u003C5 minutes from a fresh shell?**\n   - The Python snippet above is the canonical reproduction. Include it verbatim in the report.\n\n---\n\n## Real Impact Examples\n\n### Scenario A — Enterprise SharePoint inside parent corporate AD\n\nTarget: `https:\u002F\u002Ftarget-portal.example\u002F` — a enterprise dealer portal (test mirror) operated by a system integrator.\n\nSending the anonymous Type-1 message to `\u002F_api\u002Fweb\u002FCurrentUser` returned a Type-2 challenge whose AV_PAIRS decoded to:\n\n```\nNetBIOS Domain Name:    \u003CCustomerName>\nNetBIOS Computer Name:  WIN-XXXXXXXXXXX\nDNS Domain Name:        customer.parent-corp.example\nDNS Computer Name:      WIN-XXXXXXXXXXX.customer.parent-corp.example\nDNS Tree Name:          customer.parent-corp.example\nTimestamp:              2026-05-13T15:55:37.922Z\n```\n\nThree escalation paths:\n1. **Default Windows-installer hostname (`WIN-XXXXXXXXXXX`)** — server was never renamed after OS install; strong signal of lazy provisioning. Likely default service-account passwords on the SQL backend, default WSUS config, etc.\n2. **Sub-domain inside corporate-parent AD (`customer.parent-corp.example`)** — the customer is a child domain inside \u003CParentCorp>'s global Active Directory. A compromise of this test farm has potential cross-trust to corporate-parent.\n3. **UPN format known** — combined with `hunt-auth-bypass`'s discovery of an anonymous brute-force endpoint on `\u002F_vti_bin\u002FAuthentication.asmx`, the attacker has both the credential format (`firstname.lastname@customer.parent-corp.example` or `\u003CCustomerName>\\firstname.lastname`) and the unlimited submission endpoint.\n\nReported severity: **Medium**, with a note that the chain with the Authentication.asmx anonymous brute-force makes the combined attack Critical.\n\n### Scenario B — Exchange edge with NTLM-protected EWS\n\nTarget: `https:\u002F\u002Fmail.example.com\u002FEWS\u002FExchange.asmx`. Type-1 probe returns Type-2 with DNS Tree Name `corp.example.com` and DNS Computer Name `MAIL01.corp.example.com`. Confirms the Exchange edge is domain-joined to corporate AD (rather than running in a DMZ-isolated AD). For an attacker with the matching `hunt-mfa-bypass` \u002F `hunt-auth-bypass` chain, the leaked UPN format and server-name format accelerate credential spraying by removing the recon step. Reported severity: Low-Medium depending on program.\n\n### Scenario C — Intranet-only intentional leak (not a finding)\n\nTarget: `https:\u002F\u002Fintranet.corp.example` (clearly internal, behind VPN). Type-1 returns full AV-pair set. Not reportable — this is intended NTLM behavior on intranet, and the disclosure is to authenticated VPN users who already see the same data via `nltest \u002Fdsgetdc:corp.example.com`. Recognize and drop.\n\n---\n\n## Related Skills & Chains\n\n- **`hunt-sharepoint`** — SharePoint farms emit anonymous Type-2 challenges on `\u002F_vti_bin\u002F` by default; this is one of the most reliable ways to get internal AD topology. Chain primitive: SharePoint discovered → NTLM Type-2 capture on `\u002F_vti_bin\u002FLists.asmx` → `hunt-ntlm-info` AV_PAIR decode → internal forest name → `m365-entra-attack` ROPC spray on Entra tenant tied to that forest.\n- **`m365-entra-attack`** — Leaked NetBIOS domain + UPN suffix is the missing piece for a credible password spray. Chain primitive: NTLM Type-2 yields `corp.example.com` DNS tree → cross-reference Entra tenant via `https:\u002F\u002Flogin.microsoftonline.com\u002Fcorp.example.com\u002F.well-known\u002Fopenid-configuration` → `m365-entra-attack` AADSTS error-differential username enumeration on resolved tenant.\n- **`hunt-aspnet`** — IIS sites running ASP.NET frequently expose NTLM on management paths. Chain primitive: NTLM Type-2 on `\u002Fowa\u002F`, `\u002Fecp\u002F`, `\u002Frpc\u002F`, `\u002Faspnet_client\u002F` → confirm IIS + ASP.NET version → `hunt-aspnet` ViewState \u002F `.axd` enumeration on same host.\n- **`offensive-osint`** — The hostname pattern `WIN-XXXXXXXXXXX` signals lazy provisioning and predicts other weak hygiene. Chain primitive: NTLM Type-2 returns default-installer hostname → flag as low-maturity environment → `offensive-osint` deep recon (cert transparency, GitHub leakage, breach corpus correlation) is high-yield on this org.\n- **`triage-validation`** — Most NTLM info-disclosure findings die at the 7-Question Gate on \"is this exploitable\" — pure topology disclosure is Low\u002FInformational. Chain primitive: pull every NTLM-info finding through `triage-validation` BEFORE writing it up; only report if (a) leaks UPN format that accelerates spray, or (b) leaks production hostname mapping (`redteam-report-template` for the chain-narrative).\n\n## When to Use\n\n- You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.\n- You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.\n\n## Limitations\n\n- Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.\n- Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.\n- Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.\n\n### Example\n\n```bash\n# Read-only first step; confirm scope before anything active.\ncat scope.txt  # target list from the authorized engagement brief\n```\n\n> Adapted from [elementalsouls\u002FClaude-BugHunter](https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: executable helpers, commands, engine, and research assets not bundled.\n",{"name":5,"risk":27,"source":43,"license":14,"sources":44,"category":37,"date_added":45,"description":7,"source_repo":46,"source_type":33,"report_count":47,"compatibility":48,"license_source":49},"https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter","github, authorized-engagement","2026-09-20","elementalsouls\u002FClaude-BugHunter",1,"Requires explicit written authorization for a target scope plus the relevant testing tools for this technique. Docs-only; helper scripts and commands not bundled.","https:\u002F\u002Fgithub.com\u002Felementalsouls\u002FClaude-BugHunter\u002Fblob\u002Fmain\u002FLICENSE","f3312ba749561b6159f477dbfc9313c875d40a56",".agents\u002Fskills_archive\u002Fhunt-ntlm-info","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612","2026-10-25 23:50:58",{"source":8,"skillName":5,"commands":56,"prompt":66,"zipAvailable":67},[57,60,63],{"tool":58,"command":59},"npx","npx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill hunt-ntlm-info",{"tool":61,"command":62},"bunx","bunx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill hunt-ntlm-info",{"tool":64,"command":65},"pnpm","pnpm dlx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill hunt-ntlm-info","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fhunt-ntlm-info\u002FSKILL.md",true,[],[70,95,119,143,171,195],{"skillNo":71,"name":72,"nameZh":6,"description":73,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":74,"categories":75,"keywords":81,"publishedAt":38},"01M6Q0FA5FZ410Z33Z3TFQ4DBA","zero-trust","Implement zero-trust network architecture. Configure identity-based access, micro-segmentation, and continuous verification. Use when implementing modern security architectures.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzero-trust\u002FSKILL.md",[76],{"categoryNo":77,"categoryName":78,"taxonomyType":79,"taxonomyTypeDesc":80},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[82,83,84,85,86,87,72,88,89,90,91,34,33,32,92,93,21,29,25,94],"ZeRO","trust","zero trust","architecture","assessment","verification","segmentation","devops-security","access","configure","active","critical","implementing",{"skillNo":96,"name":97,"nameZh":6,"description":98,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":99,"categories":100,"keywords":101,"publishedAt":38},"01M6Q0F1YZJW3KX5FBKEVZ8CV4","zcode-delegate","Delegate coding tasks to the Z.AI ZCode CLI only when the user explicitly requests it, while the orchestrator retains review and landing responsibility.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzcode-delegate\u002FSKILL.md",[],[102,103,104,105,106,107,108,109,110,111,112,113,114,34,115,33,116,117,93,118],"delegate","zcode","zcode delegate","review","cli","orchestration","tasks","run","Bash","model","node","read","orchestrator","files","desktop app","app","agent-orchestration",{"skillNo":120,"name":121,"nameZh":6,"description":122,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":123,"categories":124,"keywords":125,"publishedAt":38},"01M6Q0ETK41VGNMYEXW0T00AJN","youtube-transcript","Fetch YouTube transcripts through DeepAPI or local fallback tooling and save clean text output.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript\u002FSKILL.md",[],[126,127,128,129,130,131,132,36,133,134,135,136,137,33,32,138,139,140,141,142],"transcript","youtube transcript","youtube","safe","github","codex","research","https","text","fetch","tooling","clean","local","output","deepapi","youtube transcripts","blob",{"skillNo":144,"name":145,"nameZh":6,"description":146,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":147,"categories":148,"keywords":160,"publishedAt":38},"01M6Q0EPPH2PVMDW40017F8WX0","youtube-transcript-skills","Fetch YouTube video transcripts, search videos\u002Fchannels, browse channels, and extract playlists via the getyoutubetranscript.com API - free tier, no card required.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript-skills\u002FSKILL.md",[149,152,155],{"categoryNo":150,"categoryName":151,"taxonomyType":79,"taxonomyTypeDesc":80},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":153,"categoryName":154,"taxonomyType":79,"taxonomyTypeDesc":80},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":156,"categoryName":157,"taxonomyType":158,"taxonomyTypeDesc":159},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[126,127,128,161,129,162,130,131,36,163,164,165,166,135,167,33,32,168,169,170],"youtube transcript skills","gemini","search","api","Video","browse","api-integration","free","card","channels",{"skillNo":172,"name":173,"nameZh":6,"description":174,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":175,"categories":176,"keywords":181,"publishedAt":38},"01M6Q0EAB96PX83W5PTE8A0R8D","youtube-notetaker","Turn YouTube talks into local study notes with slides, transcripts, editable annotations, and a markdown-backed viewer.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-notetaker\u002FSKILL.md",[177,180],{"categoryNo":178,"categoryName":179,"taxonomyType":79,"taxonomyTypeDesc":80},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":153,"categoryName":154,"taxonomyType":79,"taxonomyTypeDesc":80},[128,182,183,106,129,184,185,186,187,36,165,188,189,190,191,32,192,138,193,194],"youtube notetaker","notetaker","workflow","official","notes","code","markdown","slides","annotations","README","study","dair-academy","viewer",{"skillNo":196,"name":197,"nameZh":6,"description":198,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":199,"categories":200,"keywords":202,"publishedAt":38},"01M6Q0E55F0GW5MX48V8HXS8B5","youtube-full","Fetch YouTube transcripts, search videos, browse channels, and extract playlists via TranscriptAPI — no yt-dlp, no Google API key, works from any cloud server.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-full\u002FSKILL.md",[201],{"categoryNo":150,"categoryName":151,"taxonomyType":79,"taxonomyTypeDesc":80},[203,128,204,205,129,162,163,206,207,164,165,166,135,208,167,33,32,168,209,141],"youtube full","full","google","server","dlp","credits","automatic"]