How to distinguish between ntlm & ntlmv2 authentication

Question

I'm viewing some legacy code and attempting to determine if the application is using ntlm or ntlmv2.

Viewing the source the response header set to "WWW-Authenticate", "NTLM".

But I'm not sure if this is an indication of the authentication type.

How to distinguish between ntlm & ntlmv2 authentication ?

Have a look at this link. [https://richardkok.wordpress.com/2011/02/03/wireshark-determining-a-smb-and-ntlm-version-in-a-windows-environment/] — zakaiter, Feb 17 '16 at 07:21
https://richardkok.wordpress.com/2011/02/03/wireshark-determining-a-smb-and-ntlm-version-in-a-windows-environment/ — zakaiter, Feb 17 '16 at 07:45
**Same kind of question is asked here, hope it helps** [How to determine NTLMv1 VS NTLMv2 traffic in netmon](https://social.technet.microsoft.com/Forums/en-US/dcf004ca-ae72-4d04-ab07-10ece3143ae6/how-to-determine-ntlmv1-vs-ntlmv2-traffic-in-netmon?forum=netmon) — zakaiter, Feb 17 '16 at 07:52

score -1 · Answer 1 · answered Aug 05 '15 at 17:04

-1

You can't unless you dissect the messages.

answered Aug 05 '15 at 17:04

Michael-O

thanks, is there a signature within the messages that will determine this ? – blue-sky Aug 06 '15 at 09:38
Read the specs for the type 1 message: https://msdn.microsoft.com/en-us/library/cc236641.aspx – Michael-O Aug 06 '15 at 19:46

1 Answers1