Reminder: domain names, server names, and OS versions can be retrieved from HTTP (MSSQL, RDP, SMTP...) services that support NTLM authentication. Nmap *-ntlm-info NSE scripts can easily enumerate this. #osint#osintHacks#netspi
Want to check if a target is using Azure services? Microburst can enumerate common Azure services, such as Blob Storage or Key Vaults. Come see @kfosaaen talk Azure cloud privilege escalation at DerbyCon 2019! blog.netspi.com/enumerating-az…#osint#osintHacks#Azure
