gchq / gchq/CyberChef

Feature request: NTLM Challenge Decoder

Open
#1,107 0 comments 1 reaction 0 assignees View on GitHub
feature
Dominant language
JavaScript
Stars
35.8k
Forks
4.1k
Avg merge
2d 26m
Merged PRs (30d)
33

Description

**Describe the solution you'd like**
I'd like to decode NTLM SSP headers to reveal:
- The server's hostname
- The server's operating system
- The server's timestamp
- The domain's name
- The domain's FQDN
- The parent domain's name

**Describe alternatives you've considered**
There are a few projects that do this, namely this Burp Suite [extension](https://github.com/PortSwigger/ntlm-challenge-decoder).

**Additional context**
This is a great resource on the functionality of NTLM challenges: http://davenport.sourceforge.net/ntlm.html

Contributor guide

Open the contributing guide

Research direction

Start with the NTLM challenge format described in the Davenport reference and compare the linked Burp Suite extension's behavior. Identify CyberChef's existing operation structure and testing approach before deciding where the decoder belongs; done means decoding the requested hostname, operating system, timestamp, domain, FQDN, and parent domain from NTLM SSP headers.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
authentication, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.