Kerberos Authentication
Summary: PortSwigger's BApp Store lists a Burp Suite extension, version 1.0.1 by Richard Turnbull of NCC Group, that adds Kerberos authentication support for testing in a Windows domain where NTLM authentication is not supported. The extension does not require the machine running Burp to be a domain member or to run Windows, and its estimated system impact is rated Low.
What you should know: Kerberos is the default authentication protocol in most Windows domains, so testers who can only authenticate with NTLM leave a large share of in-scope applications untested. PortSwigger states it makes no warranty about the quality or usefulness of third-party extensions, so the tooling that reaches those applications carries no vendor assurance.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026