🧰 impacket-ntlmrelayx

The items that name it 2

• Microsoft Windows NCSI Cross-Context Proxy Authentication Coercion - ZDI-26-708 - Part 1
  writeup2026-09-28

  Used as attacker-controlled WPAD/PAC and HTTP proxy endpoint to capture and relay NTLM authentication from NCSI probes

• Microsoft Windows NCSI Cross-Context Proxy Authentication Coercion - ZDI-26-708 - Part 2
  writeup2026-09-28

  HTTP server used to capture/relay NTLM proxy authentication (returns 407 Proxy Authentication Required, advertises NTLM, relays to ADCS)