Internal Infrastructure

NTLM Relay

An attacker captures or coerces an NTLM authentication flow and relays it to a service that accepts it, turning trust between systems into access.

RedMawJuly 20, 2026

Definition

Rather than recovering a password, relay takes an authentication attempt in flight and presents it to a different service, which accepts it as legitimate.

Why it works

The technique depends on two conditions: an authentication flow that can be observed or induced, and a target service that accepts the forwarded authentication because signing, channel binding or equivalent protections are absent. Neither condition is a software defect in the usual sense. Both are configuration and protocol-support decisions.

Why it is a strong internal technique

No credential is stored, cracked or reused in a detectable way. The authentication is genuine; only its destination is wrong. That makes it quiet, and it converts ordinary network trust into access.

Where it leads

Internal Foothold
Authentication Flow
Relay
Internal Service
Privileged Access

Each hop validated by successful exploitation

How RedMaw validates this attack

Validation runs only inside authorized scope, with agreed exploitation limits.

01Establish which services accept unsigned or unbound authentication
02Identify authentication flows that can be observed or induced
03Determine what a successful relay would reach
04Report the protocol and configuration exposure

Keep going

Capabilities

Internal InfrastructureEstablishing which internal servers, routers and switches can actually be accessed from an authorized foothold, and what those systems expose. Access is demonstrated and reported, never disrupted.

Use cases

Attack-path validation

Stop assuming you are secure. Prove it.

Continuously test what an attacker can actually reach across your applications, SaaS identities, internal infrastructure and AI systems.

Request a demo Explore the platform