1

I am writing a program in Python using the requests-ntlm library. That library adds support for NTLM in regular requests:

import requests
from requests_ntlm import HttpNtlmAuth
requests.get("http://ntlm_protected_site.com",auth=HttpNtlmAuth('domain\\username','password'))

I intend to make many requests, but I don't know which ones need NTLM. Is it secure to try an NTLM handshake with any server? Is a malicious server able to get a secret?

  • The NTLM Type 1 message offered is harmless. However if a website actually accepts it and completes the handshake you are in danger. Hopefully your library only uses NTLMv2 so the response cannot be passed on, but it still can be used to bruteforce the password. – eckes Mar 9 at 3:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.