# coontzy1/ntlmscan architecture

> Architecture diagram of the GitHub repository coontzy1/ntlmscan, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/coontzy1/ntlmscan
- Repository: https://github.com/coontzy1/ntlmscan

## Overview

ntlmscan is a command-line scanner that tests supplied URLs or hosts for HTTP NTLM authentication. Its main workflow builds candidate URLs from user inputs and a path dictionary, dispatches probes to worker threads, records matching URLs, and can optionally run Nmap’s http-ntlm-info script on matches. The README also identifies common target types and the intended Nmap follow-up. The supplied source shows the runtime orchestration and probe logic; no separate implementations for target-specific discovery are present.

Main entry points: [`ntlmscan/__main__.py`](https://github.com/coontzy1/ntlmscan/blob/master/ntlmscan/__main__.py) (CLI orchestration), [`ntlmscan/paths.dict`](https://github.com/coontzy1/ntlmscan/blob/master/ntlmscan/paths.dict) (Path dictionary)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_inputs["Scan inputs"]
  node_main["CLI orchestration<br/>[__main__.py]"]
  node_hostfile["Host list"]
  node_urlfile["URL list"]
  node_paths["Path dictionary<br/>[paths.dict]"]
end

subgraph group_runtime["Probe and detection"]
  node_queue["Work queue<br/>[__main__.py]"]
  node_workers["Probe workers<br/>[__main__.py]"]
  node_detector["NTLM detection<br/>[__main__.py]"]
end

subgraph group_results["Results and enrichment"]
  node_found["Matched URLs<br/>[__main__.py]"]
  node_outfile["Result log"]
  node_nmap["Nmap scanner"]
end

node_user(("CLI user"))
node_web(("HTTP targets"))

node_user -->|"provides options"| node_main
node_main -.->|"reads when supplied"| node_hostfile
node_main -.->|"reads when supplied"| node_urlfile
node_main -->|"reads paths"| node_paths
node_main -->|"enqueues URLs"| node_queue
node_queue -->|"dispatches work"| node_workers
node_workers -->|"sends HEAD requests"| node_web
node_workers -->|"passes responses"| node_detector
node_detector -->|"records matches"| node_found
node_detector -->|"appends matches"| node_outfile
node_main -.->|"runs optionally"| node_nmap
node_nmap -.->|"scans matched targets"| node_web

click node_main "https://github.com/coontzy1/ntlmscan/blob/master/ntlmscan/__main__.py"
click node_paths "https://github.com/coontzy1/ntlmscan/blob/master/ntlmscan/paths.dict"
click node_queue "https://github.com/coontzy1/ntlmscan/blob/master/ntlmscan/__main__.py"
click node_workers "https://github.com/coontzy1/ntlmscan/blob/master/ntlmscan/__main__.py"
click node_detector "https://github.com/coontzy1/ntlmscan/blob/master/ntlmscan/__main__.py"
click node_found "https://github.com/coontzy1/ntlmscan/blob/master/ntlmscan/__main__.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_main,node_hostfile,node_urlfile,node_paths,node_user toneBlue
class node_queue,node_workers,node_detector toneAmber
class node_found,node_outfile,node_nmap toneMint
class node_web toneIndigo
```

## Components

### Scan inputs

- [CLI orchestration](https://github.com/coontzy1/ntlmscan/blob/master/ntlmscan/__main__.py): `ntlmscan/__main__.py`
- **Host list**
- **URL list**
- [Path dictionary](https://github.com/coontzy1/ntlmscan/blob/master/ntlmscan/paths.dict): `ntlmscan/paths.dict`

### Probe and detection

- [Work queue](https://github.com/coontzy1/ntlmscan/blob/master/ntlmscan/__main__.py): `ntlmscan/__main__.py`
- [Probe workers](https://github.com/coontzy1/ntlmscan/blob/master/ntlmscan/__main__.py): `ntlmscan/__main__.py`
- [NTLM detection](https://github.com/coontzy1/ntlmscan/blob/master/ntlmscan/__main__.py): `ntlmscan/__main__.py`

### Results and enrichment

- [Matched URLs](https://github.com/coontzy1/ntlmscan/blob/master/ntlmscan/__main__.py): `ntlmscan/__main__.py`
- **Result log**
- **Nmap scanner**

### Other components

- **CLI user**
- **HTTP targets**

## Connections

- CLI user → CLI orchestration: provides options
- CLI orchestration → Host list: reads when supplied
- CLI orchestration → URL list: reads when supplied
- CLI orchestration → Path dictionary: reads paths
- CLI orchestration → Work queue: enqueues URLs
- Work queue → Probe workers: dispatches work
- Probe workers → HTTP targets: sends HEAD requests
- Probe workers → NTLM detection: passes responses
- NTLM detection → Matched URLs: records matches
- NTLM detection → Result log: appends matches
- CLI orchestration → Nmap scanner: runs optionally
- Nmap scanner → HTTP targets: scans matched targets