Michel Barneveld
To unpathed waters, undreamed shores
Kerberos Authentication Tester

 

Quite often I am wondering if a site is using Kerberos or NTLM. You can use tools like Fiddler, Network Monitor and such for that. But sometimes I just want to have a simple tool without installation like when working on computers where you can't install such software but are allowed to run executables. For that I have created a tool: Kerberos Authentication Tester.

Kerberos Authentication Tester Features:

  • It shows what authentication method is used in a web request: None, Basic, NTLM or Kerberos
  • It shows the SPN used in case of Kerberos
  • It shows the HTTP status
  • It shows the HTTP Headers of the request.
  • It shows the version of NTLM used (v1 or v2)
  • It has a detailed view with a complete breakdown of the Authorization header. (Yep, went through all the RFCs to dissect the Kerberos and NTLM packages)
  • It shows your current Kerberos tickets and allows you to remove them (like klist.exe)

Some Screen shots:

The main form:

The blue details link at the top right shows a new screen with the details of the request, including a breakdown of the Authorization HTTP Header. You can also save this XML.

Use different credentials or a proxy:

And it also has quick access to the Kerberos Ticket of the current users. And you can even delete them.

It's still in beta, so your mileage may vary ;-)

 


Posted 12-05-2009 10:25 PM by Michel Barneveld
Filed under: , ,

Comments

Mike Donnellan wrote re: Kerberos Authentication Tester
on 11-24-2010 7:41 PM

Astounding, to me anyway.  Excellent work, many thanks!

Olivier wrote re: Kerberos Authentication Tester
on 02-09-2011 5:20 PM

brilliant stuff, thanks. helped me a lot.

cheers,

Olivier

Leen Noordzij wrote re: Kerberos Authentication Tester
on 10-06-2011 11:24 PM

Nice tool, thanks for taking the time to post it, as well as some of your other very detailed articles

Mark Davis wrote re: Kerberos Authentication Tester
on 11-17-2011 7:06 PM

I'm getting an "Unexpected Authorization Header" message. I'm having trouble figuring out what is going on. Any ideas?

Michel Barneveld wrote re: Kerberos Authentication Tester
on 11-17-2011 7:21 PM

Could you send me your 'Authorization' header from your request. It should be visible in the main screen.

You can use the contact form on my site to send the details to me: blog.michelbarneveld.nl/.../contact.aspx

Some notes:

Please test kerberos from a seperate client. Don't test it on the Domain Controller or on the Webserver. That will result in a different ticket that doesn't include all the details, which might not be parseble by my tool.

Add a Comment

(required)  
(optional)
(required)  
Remember Me?

  Enter code:
Copyright © 2003 - 2009 Michel Barneveld
Powered by Community Server (Non-Commercial Edition), by Telligent Systems