Top 10 winner

Attacking MS Exchange Web Interfaces

Arseniy Sharoglazov and @_mohemiv · PT SWARM

Surveys the ways a low-privilege domain account can attack an internet-facing MS Exchange web interface, then adds a new one: reaching the RPC over HTTP v2 proxy by the NetBIOS name leaked in NTLMSSP and abusing MS-OXNSPI address-book identifiers, which on domain controllers are database row numbers, so walking them dumps every Active Directory record.

Record

Researcher

Arseniy Sharoglazov and @_mohemiv

Published by

PT SWARM

Topic

Other

In the archive

• Ranked #9 in the 2020 Top 10 Web Hacking Techniques

Related sources

• Research utilities in Impacket

Tags

• info-leak
• auth-bypass
• ssrf
• tooling
• http
• email
• proxy
• attack-chain
• owasp-a01-2021
• owasp-a10-2021

This page is the archive's own catalogue record. The research is the work of Arseniy Sharoglazov and @_mohemiv, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.