{"record":{"id":"824f71c82697f7af","repo":"projectdiscovery/nuclei","slug":"failed-to-parse-ntlm-response-w","errorCode":null,"errorMessage":"failed to parse NTLM response: %w","messagePattern":"failed to parse NTLM response: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/telnet/telnet.go","lineNumber":274,"sourceCode":"\t// Read response data\n\tbuffer := make([]byte, 4096)\n\tn, err := conn.Read(buffer)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to read response: %w\", err)\n\t}\n\n\tif n == 0 {\n\t\treturn nil, fmt.Errorf(\"no response received\")\n\t}\n\n\t// Parse NTLM response using our telnetmini library functions\n\tresponse := buffer[:n]\n\n\t// Use the parsing functions from our library instead of reimplementing\n\t// This should use the NTLM parsing functions we added to telnetmini\n\tntlmInfo, err := telnetmini.ParseNTLMResponse(response)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to parse NTLM response: %w\", err)\n\t}\n\n\treturn ntlmInfo, nil\n}\n","sourceCodeStart":256,"sourceCodeEnd":279,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/telnet/telnet.go#L256-L279","documentation":"Returned by telnet.DetectNTLM when telnetmini.ParseNTLMResponse rejects the bytes the server sent. The exchange completed at the transport level, but the payload is not a recognizable MS-TNAP NTLM response — e.g. the server replied with plain telnet negotiation (IAC sequences), an error string, or a non-NTLM protocol frame. The parse error is wrapped verbatim from the telnetmini library.","triggerScenarios":"Probing a telnet service that negotiates normally instead of answering the NTLM login packet; non-Windows telnetd responding with a banner/prompt; NTLM disabled on the Windows host so the server declines with a non-NTLM reply.","commonSituations":"DetectNTLM pointed at port 23 of mixed-OS environments; services behind port-forwarding that speak another protocol; partial NTLM implementations that truncate the response.","solutions":["Confirm the target runs Windows telnet with NTLM auth enabled (this is what MS-TNAP probing assumes)","Treat parse failure as 'NTLM not available' and continue with other checks","Capture the raw response (adjusting the template to dump bytes) if you need to identify what the server actually sent"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { const info = client.DetectNTLM(host, port); } catch (e) { if (String(e).includes('parse NTLM')) { /* non-NTLM reply: conclude NTLM unavailable */ } else { throw e; } }","preventionTips":["Only run MS-TNAP probing against Windows telnet with NTLM enabled","Treat parse failure as a negative finding","Keep a fallback detection path (e.g. SMB NTLM info) for mixed environments"],"tags":["telnet","javascript","nuclei","ntlm","parsing"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}