feat: Update ntlm-directories to detect RDWeb WebFeedLogin

[missing0x00]

Template / PR Information

• Add detection for NTLM auth header on /RDWeb/FeedLogin/WebFeedLogin.aspx
• NTLM response discloses server and domain information
• Valid credentials allow:
  • Retrieval of .ASPXAUTH cookie (as application/x-msts-webfeed-login response)
  • Identification of RemoteApps available to the user
  • Potential cookie reuse for other applications on the IIS server
• Possible NTLM relay target, however attack vectors seem to be limited
• References: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tswp/85306e72-0f6a-41c0-9725-893d8f5aee5c
• Could make this a separate template if preferred

Template Validation

I've validated this template locally?

• YES
• NO

Additional Details (leave it blank if not applicable)

The following URLs redirect to /RDWeb/FeedLogin/WebFeedLogin.aspx when unauthenticated:

/RDWeb/Feed/
/RDWeb/Feed/WebFeed.aspx
/RDWeb/Feed/RDWebService.asmx
/RDWeb/FeedLogin/
/RDWeb/FeedLogin/WebFeedLogin.aspx

URLs which allow data retrieval using .ASPXAUTH cookie:

 POST /RDWeb/Feed/RDWebService.asmx
 GET /RDWeb/Feed/WebFeed.aspx

[GeorginaReeder]

Thanks for your contribution @missing0x00 ! :)

[DhiyaneshGeek]

Hi @missing0x00 ,

Thank you so much for updating this template and contributing to this project 🍻

You can grab some cool PD stickers over here: http://nux.gg/stickers 😄

You can join our discord server. It's a great place to connect with fellow contributors and stay updated with the latest developments.