Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum will be discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Centre. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTRE DISCORD

Create new post

NTLM Platform Auth Problem

Mark | Last updated: Feb 24, 2017 04:01PM UTC

I'm trying to proxy an internal NTLMv1 site using 1.7.13, and I have the appropriate host entries in User Options/Platform Auth, but I'm getting denied by the remote host. I can connect directly using the browser and creds with browser proxy = none. Depending on the setting experiment I'm trying, I get either Auth failure or No NTLM challenge received. I the former case, the browser pops an NTLM auth prompt, and I know Burp cannot /proxy/ NTLM. Any suggestions?

PortSwigger Agent | Last updated: Feb 24, 2017 04:15PM UTC

Are you certain that the site is using NTLMv1, rather than v2 or Kerberos? Try selecting NTLMv2 with your credentials, and try out the Kerberos extension in the BApp Store.

Burp User | Last updated: Jul 18, 2018 12:20PM UTC

Hi, I'm facing error related to this NTLM Platform Auth but in a different way. When i select Do platform authentication, Scanner running fine. But, Application responding with 302 error. If i remove Do platform authentication, application responding well were scanner resulting authentication error under alerts tab. Is there any workaround/suggestions?

PortSwigger Agent | Last updated: Jul 18, 2018 12:29PM UTC

Hi Jack, It sounds like the application does need NTLM authentication, and that you've not quite got the configuration right. Please verify the NTLM credentials you're using, in particular, check the account is not locked. Then check the config within Burp. Typically you want NTLM v2 and be aware that the domain is the Windows domain, not the DNS domain. Please let us know if you need any further assistance.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.