How coontzy1/ntlmscan works
ntlmscan is a command-line scanner that tests supplied URLs or hosts for HTTP NTLM authentication. Its main workflow builds candidate URLs from user inputs and a path dictionary, dispatches probes to worker threads, records matching URLs, and can optionally run Nmap’s http-ntlm-info script on matches. The README also identifies common target types and the intended Nmap follow-up. The supplied source shows the runtime orchestration and probe logic; no separate implementations for target-specific discovery are present.
Main entry points: __main__.py CLI orchestration · paths.dict Path dictionary
Components 12
Scan inputs
- CLI orchestration
ntlmscan/__main__.py - Host list
- URL list
- Path dictionary
ntlmscan/paths.dict
Probe and detection
- Work queue
ntlmscan/__main__.py - Probe workers
ntlmscan/__main__.py - NTLM detection
ntlmscan/__main__.py
Results and enrichment
- Matched URLs
ntlmscan/__main__.py - Result log
- Nmap scanner
Other components
- CLI user
- HTTP targets
Connections 12
- CLI user → CLI orchestration: provides options
- CLI orchestration → Host list: reads when supplied
- CLI orchestration → URL list: reads when supplied
- CLI orchestration → Path dictionary: reads paths
- CLI orchestration → Work queue: enqueues URLs
- Work queue → Probe workers: dispatches work
- Probe workers → HTTP targets: sends HEAD requests
- Probe workers → NTLM detection: passes responses
- NTLM detection → Matched URLs: records matches
- NTLM detection → Result log: appends matches
- CLI orchestration → Nmap scanner: runs optionally
- Nmap scanner → HTTP targets: scans matched targets