repository·master·Indexed 41 days ago
https://github.com/samdecrock/node-http-ntlmA Node.js library for performing HTTP requests with NTLM authentication, including NTLMv2 support. Version 1.8.13 provides methods for authenticated GET, POST, PUT, and DELETE requests, as well as a sub-module for manually managing the NTLM handshake and pre-encrypting passwords using LM and NT hashes.
You can install the httpntlm library using the Node Package Manager (npm).
npm install httpntlmFor advanced control, you can use the httpntlm.ntlm methods directly to manage the three-step NTLM handshake:
createType1Message(options): Generates the initial challenge request.parseType2Message(authHeader): Parses the server's challenge from the www-authenticate header.createType3Message(type2msg, options): Generates the final response message.var ntlm = require('httpntlm').ntlm;
var async = require('async');
var httpreq = require('httpreq');
var HttpsAgent = require('agentkeepalive').HttpsAgent;
var keepaliveAgent = new HttpsAgent();
var options = {
url: "https://someurl.com",
username: 'm$',
password: 'stinks',
workstation: 'choose.something',
domain: ''
};
async.waterfall([
function (callback){
var type1msg = ntlm.createType1Message(options);
httpreq.get(options.url, {
headers:{
'Connection' : 'keep-alive',
'Authorization': type1msg
},
agent: keepaliveAgent
}, callback);
},
function (res, callback){
if(!res.headers['www-authenticate'])
return callback(new Error('www-authenticate not found on response of second request'));
var type2msg = ntlm.parseType2Message(res.headers['www-authenticate']);
var type3msg = ntlm.createType3Message(type2msg, options);
setImmediate(function() {
httpreq.get(options.url, {
headers: {
'Connection' : 'Close',
'Authorization': type3msg
},
allowRedirects: false,
agent: keepaliveAgent
}, callback);
});
}
], function (err, res) {
if(err) return console.log(err);
console.log(res.headers);
console.log(res.body);
});Use httpntlm.get() to perform an HTTP GET request with NTLM authentication. You must provide a url and can optionally provide username, password, workstation, and domain.
var httpntlm = require('httpntlm');
httpntlm.get({
url: "https://someurl.com",
username: 'm$',
password: 'stinks',
workstation: 'choose.something',
domain: ''
}, function (err, res){
if(err) return console.log(err);
console.log(res.headers);
console.log(res.body);
});If you already have the encrypted LM and NT hashes, you can use the httpntlm.ntlm sub-module to generate them and pass them to the request instead of a plain-text password. Use ntlm.create_LM_hashed_password(password) and ntlm.create_NT_hashed_password(password) to generate the required Buffer objects.
var httpntlm = require('httpntlm');
var ntlm = httpntlm.ntlm;
var lm = ntlm.create_LM_hashed_password('Azx123456');
var nt = ntlm.create_NT_hashed_password('Azx123456');
httpntlm.get({
url: "https://someurl.com",
username: 'm$',
lm_password: lm,
nt_password: nt,
workstation: 'choose.something',
domain: ''
}, function (err, res){
if(err) return console.log(err);
console.log(res.headers);
console.log(res.body);
});The following options are available for the httpntlm.get() method (and other HTTP methods like POST, PUT, or DELETE which inherit options from httpreq):
| Option | Type | Description |
|---|---|---|
url | String | URL to connect. (Required) |
username | String | Username (optional, default: '') |
password | String | Password (optional, default: '') |
workstation | String | Name of workstation (optional, default: '') |
domain | String | Name of domain (optional, default: '') |
agent | Agent | An agent to reuse the keepaliveAgent over different calls (optional) |
headers | Object | Custom headers. Note: Connection and Authorization are used by NTLM and cannot be passed manually. |
lm_password | Buffer | Encrypted LM password. Use this instead of password if you have the hash. |
nt_password | Buffer | Encrypted NT password. Use this instead of password if you have the hash. |
binary | Boolean | Set to true for downloading binary files. |