{"record":{"id":"acfb4a5773817ad4","repo":"projectdiscovery/nuclei","slug":"ntlm-response-too-short-need-at-least-48-bytes-g","errorCode":null,"errorMessage":"NTLM response too short: need at least 48 bytes, got %d","messagePattern":"NTLM response too short: need at least 48 bytes, got (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"pkg/utils/telnetmini/ntlm.go","lineNumber":47,"sourceCode":"\tntlmStart := bytes.Index(data, []byte(\"NTLMSSP\"))\n\tif ntlmStart == -1 {\n\t\treturn nil, fmt.Errorf(\"NTLMSSP signature not found in response\")\n\t}\n\n\t// Find the end of NTLM data (Sub-option End: 0xFF 0xF0)\n\tntlmEnd := bytes.Index(data[ntlmStart:], []byte{0xFF, 0xF0})\n\tif ntlmEnd == -1 {\n\t\treturn nil, fmt.Errorf(\"NTLM response not properly terminated with Sub-option End\")\n\t}\n\n\t// Extract NTLM data (NTLMSSP.*\\xff\\xf0)\n\tntlmData := data[ntlmStart : ntlmStart+ntlmEnd]\n\n\t// Check message type (should be 2 for Challenge).\n\t// The fixed header runs to offset 48 (target-info offset field ends at byte 48),\n\t// so reject anything shorter before touching any field offsets.\n\tif len(ntlmData) < 48 {\n\t\treturn nil, fmt.Errorf(\"NTLM response too short: need at least 48 bytes, got %d\", len(ntlmData))\n\t}\n\n\tmessageType := binary.LittleEndian.Uint32(ntlmData[8:12])\n\tif messageType != 2 {\n\t\treturn nil, fmt.Errorf(\"expected NTLM challenge message, got type %d\", messageType)\n\t}\n\n\t// Parse target name fields\n\ttargetNameLen := binary.LittleEndian.Uint16(ntlmData[12:14])\n\ttargetNameOffset := binary.LittleEndian.Uint32(ntlmData[16:20])\n\n\t// Parse target info fields\n\ttargetInfoLen := binary.LittleEndian.Uint16(ntlmData[40:42])\n\ttargetInfoOffset := binary.LittleEndian.Uint32(ntlmData[44:48])\n\n\t// Extract target name (Target Name will always be returned under any implementation)\n\tvar targetName string\n\tif targetNameLen > 0 && int(targetNameOffset) < len(ntlmData) {","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/utils/telnetmini/ntlm.go#L29-L65","documentation":"After locating NTLMSSP and the 0xFF 0xF0 terminator, ParseNTLMResponse enforces a 48-byte minimum: the fixed NTLM Challenge header (through the target-info offset field ending at byte 48) must be intact before any field offsets are read. Shorter blobs return 'NTLM response too short: need at least 48 bytes, got %d' — a hardening check to prevent out-of-range slices and panics on garbage data.","triggerScenarios":"An NTLMSSP signature followed by a terminator but with fewer than 48 bytes between them: heavily truncated payloads, decoy/honeypot banners containing the literal string 'NTLMSSP', or non-standard implementations emitting abbreviated messages. The distance between signature and terminator is exactly what is measured.","commonSituations":"Honeypots and tarpits that echo keywords to elicit further probes; aggressive scanners pasting the NTLMSSP magic without a real message; responses cut by the 1-second read deadline mid-payload.","solutions":["Treat as malformed/unsupported NTLM and continue the scan — the data carries no parseable info","Retry once to rule out transient truncation from read deadlines","Raise the timeout if integrating telnetmini directly and targeting high-latency networks","If it reproduces deterministically, hexdump the payload — likely a decoy or non-compliant device worth noting in findings"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Enforce the same 48-byte floor before parsing:\nstart := bytes.Index(raw, []byte(\"NTLMSSP\"))\nend := bytes.Index(raw[start:], []byte{0xFF, 0xF0})\nif end < 48 {\n    return nil, fmt.Errorf(\"NTLM blob too short (%d bytes) — malformed or decoy\", end)\n}\n// safe to call ParseNTLMResponse","typeGuard":"func ntlmLongEnough(data []byte) bool {\n    i := bytes.Index(data, []byte(\"NTLMSSP\"))\n    if i == -1 { return false }\n    j := bytes.Index(data[i:], []byte{0xFF, 0xF0})\n    return j >= 48\n}","tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"too short\") {\n    // malformed/decoy payload — record host as 'NTLM malformed' and move on\n    return nil\n}","preventionTips":["Never index NTLM fields without the length check — the parser's guard exists to prevent panics","Hexdump persistently-short blobs; honeypots often fake the signature","Rate-limit probes so slow servers can finish sending the blob"],"tags":["telnet","ntlm","malformed-data","bounds-check","network-protocol"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}