Forum Discussion

1 Reply

  • If it's form based it's easy: you'll see it -> username and password fields are "embedded" in the page.

     

    If it's a popup you should connect to the server directly and check the http response (with developer tools) you receive on the OWA logon page. This helps differentiate between basic-auth and ntlm. To differentiate NTLM1&2: if the NTLM challenge is 24 bytes length then it's NTLMv1, if larger it's NTLMv2.