{"record":{"id":"92d61f2998268c3d","repo":"projectdiscovery/nuclei","slug":"ntlm-missing-ntlmssp-signature","errorCode":null,"errorMessage":"ntlm: missing NTLMSSP signature","messagePattern":"ntlm: missing NTLMSSP signature","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/http/ntlm.go","lineNumber":93,"sourceCode":"\t\ts = strings.TrimSpace(s[10:])\n\t}\n\t// Some servers return \"Negotiate <spnego>\" - still try base64 of remainder.\n\traw, err := base64.StdEncoding.DecodeString(s)\n\tif err != nil {\n\t\traw, err = base64.RawStdEncoding.DecodeString(s)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"ntlm: base64 decode: %w\", err)\n\t\t}\n\t}\n\treturn raw, nil\n}\n\nfunc parseNTLMMessage(data []byte) (*NTLMInfo, error) {\n\tif len(data) < 12 {\n\t\treturn nil, fmt.Errorf(\"ntlm: message too short\")\n\t}\n\tif !bytes.HasPrefix(data, []byte(\"NTLMSSP\\x00\")) {\n\t\treturn nil, fmt.Errorf(\"ntlm: missing NTLMSSP signature\")\n\t}\n\tmsgType := binary.LittleEndian.Uint32(data[8:12])\n\tinfo := &NTLMInfo{MessageType: int(msgType)}\n\tif msgType != 2 {\n\t\t// Type 1/3: return type only; TargetInfo is Type-2 specific.\n\t\treturn info, nil\n\t}\n\tif len(data) < 48 {\n\t\treturn nil, fmt.Errorf(\"ntlm: challenge too short\")\n\t}\n\n\ttargetNameLen := binary.LittleEndian.Uint16(data[12:14])\n\ttargetNameOffset := binary.LittleEndian.Uint32(data[16:20])\n\tif targetNameLen > 0 && int(targetNameOffset)+int(targetNameLen) <= len(data) {\n\t\tinfo.TargetName = decodeUTF16LE(data[targetNameOffset : targetNameOffset+uint32(targetNameLen)])\n\t}\n\n\tnegotiateFlags := binary.LittleEndian.Uint32(data[20:24])","sourceCodeStart":75,"sourceCodeEnd":111,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/http/ntlm.go#L75-L111","documentation":"The base64 decoded fine but the first 8 bytes are not the 'NTLMSSP\\x00' signature. DecodeNTLM only understands NTLMSSP blobs; the bytes are almost certainly a Kerberos AP-REQ / SPNEGO token (which commonly starts with 0x60 or 0x6A DER tags) or arbitrary data.","triggerScenarios":"Decoding a 'Negotiate <token>' header where the server chose Kerberos; passing base64 of a random string; passing the base64 of an already-decoded NTLM message; decoding the client's own Authorization echo instead of the server challenge.","commonSituations":"IIS/Exchange servers configured Kerberos-only or Kerberos-preferred under the Negotiate scheme; hybrid setups where the same endpoint answers NTLM on one path and Kerberos on another; templates assuming Negotiate always means NTLM.","solutions":["Force NTLM: send Authorization: NTLM <http.NegotiateNTLM()> and decode the WWW-Authenticate of the second response, which is then guaranteed NTLMSSP","If the scheme is Negotiate and the decoded token starts with Kerberos DER tags, use a Kerberos parser instead of DecodeNTLM","Confirm the decoded bytes begin with 4E 54 4C 4D 53 53 50 00 ('NTLMSSP\\x00') before asserting NTLM fields"],"exampleFix":"// before\nconst info = http.DecodeNTLM(resp.GetHeader('WWW-Authenticate'));\n\n// after - force an NTLM challenge first\nclient.SetHeader('Authorization', 'NTLM ' + http.NegotiateNTLM());\nconst resp2 = client.Get(url);\nconst h = resp2.GetHeader('WWW-Authenticate') || '';\nif (/^ntlm\\s+/i.test(h)) {\n  const info = http.DecodeNTLM(h);\n}","handlingStrategy":"validation","validationCode":"// Force NTLM so the challenge is NTLMSSP, not a Kerberos SPNEGO token\nclient.SetHeader('Authorization', 'NTLM ' + http.NegotiateNTLM());\nconst resp2 = client.Get(url);\nconst h = resp2.GetHeader('WWW-Authenticate') || '';\nif (/^ntlm\\s+/i.test(h)) {\n  const info = http.DecodeNTLM(h);\n}","typeGuard":null,"tryCatchPattern":"try {\n  const info = http.DecodeNTLM(blob);\n} catch (e) {\n  // Valid base64 but not NTLMSSP (likely Kerberos); skip NTLM parsing\n}","preventionTips":["Do not assume the Negotiate scheme implies NTLM; servers may choose Kerberos","Drive the handshake yourself: Type-1 in, decode the Type-2 challenge out"],"tags":["ntlm","spnego","kerberos","signature"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}