projectdiscovery/nuclei · error

failed to parse NTLM response: %w

Error message

failed to parse NTLM response: %w

What it means

Returned by telnet.DetectNTLM when telnetmini.ParseNTLMResponse rejects the bytes the server sent. The exchange completed at the transport level, but the payload is not a recognizable MS-TNAP NTLM response — e.g. the server replied with plain telnet negotiation (IAC sequences), an error string, or a non-NTLM protocol frame. The parse error is wrapped verbatim from the telnetmini library.

Source

Thrown at pkg/js/libs/telnet/telnet.go:274

	// Read response data
	buffer := make([]byte, 4096)
	n, err := conn.Read(buffer)
	if err != nil {
		return nil, fmt.Errorf("failed to read response: %w", err)
	}

	if n == 0 {
		return nil, fmt.Errorf("no response received")
	}

	// Parse NTLM response using our telnetmini library functions
	response := buffer[:n]

	// Use the parsing functions from our library instead of reimplementing
	// This should use the NTLM parsing functions we added to telnetmini
	ntlmInfo, err := telnetmini.ParseNTLMResponse(response)
	if err != nil {
		return nil, fmt.Errorf("failed to parse NTLM response: %w", err)
	}

	return ntlmInfo, nil
}

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Confirm the target runs Windows telnet with NTLM auth enabled (this is what MS-TNAP probing assumes)
2. Treat parse failure as 'NTLM not available' and continue with other checks
3. Capture the raw response (adjusting the template to dump bytes) if you need to identify what the server actually sent

try { const info = client.DetectNTLM(host, port); } catch (e) { if (String(e).includes('parse NTLM')) { /* non-NTLM reply: conclude NTLM unavailable */ } else { throw e; } }

When it happens

Trigger: Probing a telnet service that negotiates normally instead of answering the NTLM login packet; non-Windows telnetd responding with a banner/prompt; NTLM disabled on the Windows host so the server declines with a non-NTLM reply.

Common situations: DetectNTLM pointed at port 23 of mixed-OS environments; services behind port-forwarding that speak another protocol; partial NTLM implementations that truncate the response.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• failed to send MS-TNAP login packet: %w
• no response received
• failed to read response: %w
• expected NTLM challenge message, got type %d
• authentication failed

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/824f71c82697f7af. Report an issue: GitHub.