exchange-owa-attack

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is explicit offensive guidance for unauthorized Exchange/OWA reconnaissance and credential theft (NTLM Type‑2 decoding to steal AD/domain/computer identifiers, endpoint mapping, autodiscover leakage, and password‑spray/brute‑force testing), indicating deliberate malicious intent and high abuse risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow (Phase 2/3/4) ingests outsider-controlled HTTP response bodies/headers from attacker-specified Exchange/OWA endpoints like https://$TARGET/owa/ and /autodiscover/autodiscover.xml at runtime via curl, enabling parsing/decoding of text returned from the outsider-chosen target.