NTLM
A challenge-response authentication protocol used by Windows before Kerberos and still present as a fallback. The client proves knowledge of a password hash without sending the password, but the hash itself is sufficient to authenticate, which is the root of pass-the-hash and relay attacks.
NTLM has no mutual authentication in its common configurations and no binding between the authentication and the channel it travels over, so an attacker who can coerce a machine to authenticate to them can often relay that authentication elsewhere. Microsoft has been working to remove it from Windows for years. Most environments still cannot disable it, because some application, appliance, or hard-coded script depends on it, and finding those dependencies is the actual project.
See also: Kerberos, Active Directory, lateral movement, credential manager key extraction
Related on Start with Identity
- GlossaryLDAP
Lightweight Directory Access Protocol. A protocol for querying and modifying a hierarchical directory of entries, each identified by a distinguished name. Used
- BlogA FreeIPA flaw chain let an anonymous client write itself a reusable administrator credential
CVE-2026-76578 (CVSS 9.8) chains with a 389 Directory Server ownership-check bug so an unauthenticated client can create an OTP token entry, pass the ownership
- GlossaryAttack Path
A chain of individually legitimate permissions and relationships that together let a low-privileged identity reach a high-privileged one. Each link is a valid c
- CVECheckSum, Kerberos S4U missing cryptographic step
The KDC skipped a cryptographic step in PA-S4U-X509-USER (CWE-325). An attacker can forge an identity via S4U2self and escalate to domain compromise. Presented
- GlossaryIdentity Resilience
The ability to keep authenticating and authorising legitimate users, and to recover the identity system itself, when the identity provider or directory is degra
- CVEKerberLoss, invisible-Unicode SPN uniqueness bypass
Active Directory treated look-alike SPNs with invisible Unicode as unique. An attacker can hijack a service name, force NTLM downgrade, and steal credentials. S