Glossary
NTLM RELAY
defined.
An attack where an attacker captures NTLM authentication traffic and relays it to a different target service to authenticate as the victim.
A–Z
An attack where an attacker captures NTLM authentication traffic and relays it to a different target service to authenticate as the victim.
Variants include LLMNR/NBT-NS poisoning, IPv6 takeover via mitm6, PetitPotam, and PrinterBug. SMB signing, LDAP signing/channel binding, and EPA on HTTP services close the relay gaps.
See our web application penetration testing, API security testing, network penetration testing, and cloud security audit services for how we test for and defend against this class of issue.
30-minute call with an OSCP-certified engineer. Tailored proposal in 24 hours.