ntlm-authentication-discovery.bcheck

metadata:
  language: v1-beta
  name: "NTLM Authentication Detection"
  description: "Detects NTLM authentication on non-standard directories."
  author: "@puzzlepeaches"
  tags: "login", "ntlm", "authentication"

given request then
    send request called check:
        method: "GET"
        appending headers:
            "Authorization": "NTLM TlRMTVNTUAABAAAAB4IIAAAAAAAgAAAAAAAAACAAAAA="

    if {check.response.status_code} is "401" and {check.response.headers} matches "WWW-Authenticate: NTLM" then 
            report issue:
                severity: low 
                confidence: firm
                detail: "NTLM authentication is enabled on a non-standard directory."
                remediation: "Disable NTLM authentication in favor of modern authentication protocols."
    end if