Feature request: NTLM Challenge Decoder
- Dominant language
- JavaScript
- Stars
- 35.8k
- Forks
- 4.1k
- Avg merge
- 2d 26m
- Merged PRs (30d)
- 33
Description
**Describe the solution you'd like**
I'd like to decode NTLM SSP headers to reveal:
- The server's hostname
- The server's operating system
- The server's timestamp
- The domain's name
- The domain's FQDN
- The parent domain's name
**Describe alternatives you've considered**
There are a few projects that do this, namely this Burp Suite [extension](https://github.com/PortSwigger/ntlm-challenge-decoder).
**Additional context**
This is a great resource on the functionality of NTLM challenges: http://davenport.sourceforge.net/ntlm.html
Contributor guide
Research direction
Start with the NTLM challenge format described in the Davenport reference and compare the linked Burp Suite extension's behavior. Identify CyberChef's existing operation structure and testing approach before deciding where the decoder belongs; done means decoding the requested hostname, operating system, timestamp, domain, FQDN, and parent domain from NTLM SSP headers.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100