The ntlmscout tool has been released for analyzing NTLM endpoints

Developers introduced ntlmscout — a specialized tool in Python, designed for scanning available NTLM endpoints from the internet. The utility allows collecting data on the internal Active Directory infrastructure without the need for authorization.

The functionality of ntlmscout includes extracting operating system versions, domain names, and internal IP addresses of target servers. The tool supports working with multiple network protocols, which expands the possibilities for gathering information in various network configurations.

One of the key features is the built-in "lockout-safe" mode for conducting password spray attacks. This mechanism minimizes the risk of account lockout when testing password policy resilience, making it suitable for conducting legal penetration tests.

The tool is aimed at information security specialists involved in network perimeter auditing. The project's source code is available in an open repository, allowing it to be integrated into existing pipelines for automated detection of vulnerable nodes in corporate environments.