ntlmscan: scan for NTLM directories
ntlmscan scan for NTLM directories reliable targets are: OWA servers Skype for Business/Lync servers Autodiscover servers (autodiscover.domain.com and lyncdiscover.domain.com) once identified, use nmap and the http-ntlm-info script to extract internal domain/server information...
