Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm troubleshooting a problem with one of our vendors and plan to send them a Fiddler trace of the http traffic between the client and our servers while replicating the issue.

Our servers use NTLM authentication so the NTLM token is passed in the http authorization header. If the token captured in the Fiddler trace can be used by someone else to impersonate the authenticated user I need to scrub it from the trace. Is it necessary for me to scrub it?

share|improve this question
up vote 0 down vote accepted

Yes, you should remove the authorization header unless you are absolutely certain that NTLMv2 was being used.

NTLMv1 is very weak; somebody could easily brute force the password of your user, and then impersonating him or her. With NTLMv2 that is not possible.

Either version of NTLM authenticates the TCP connection with a random challenge/response, so there is no real danger of an attacker possibly reusing the token for impersonation.

Unfortunately, it is not possible to determine which NTLM version was used by looking at the token alone. You really need to check the NTLM security settings for both the client and the server at the time the TCP connection was established. If you cannot do that, remove the authorization header.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.