NTLM Challenge Decoder
Summary: PortSwigger's BApp Store lists NTLM Challenge Decoder, a Burp Suite extension by Louis Dion-Marcil, version 1.1.0, last updated 25 March 2021, that decodes NTLM SSP headers. The listing states that NTLM challenges over HTTP allow decoding of information about a server, and rates the extension's overall system impact as Low.
Why it matters: NTLM challenges sent over HTTP expose server details to anyone who can read the traffic, and this extension exists specifically to decode them - a reminder that NTLM over unencrypted HTTP is still found in the wild and hands out information about the server to whoever is listening.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026