[Noctem187]

Does anyone have experience with internal pentests in a azure environment without an onprem AD.

I have been running responder and I don't get any hashes, even though I see successful poisons.

[DramaKing]

If you're poisoning local workstations, and they have autodetect proxy enabled or try to access file shares, I don't see why not. If the machines aren't requesting wpad.dat, I suggest using NTLM Theft from GitHub. Generate an HTML file with a file://IP ADDRESS/image.jpg link and embed it into an email.

[Noctem187]

Thanks , let me give it a go!