title: NTLM authentication in ZAP
body: <p>I'm trying to do some penetration testing of REST Api using ZAP. Api uses windows authentication [domain\username] and is hosted locally on a specific port.
  First I did a test using postman to try to connect and make an example request. My config looked like this:</p>
  
  <p><a href="https://i.stack.imgur.com/MnxpS.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/MnxpS.png" alt="enter image description here"></a></p>
  
  <p>I decided to replicate this setup in OWASP zap. I set up my user:</p>
  
  <p><a href="https://i.stack.imgur.com/rIOYi.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/rIOYi.png" alt="enter image description here"></a></p>
  
  <p>then I set up authentication options in session properties:</p>
  
  <p><a href="https://i.stack.imgur.com/8zvUt.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/8zvUt.png" alt="enter image description here"></a></p>
  
  <p>and session management options:</p>
  
  <p><a href="https://i.stack.imgur.com/QrQTO.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/QrQTO.png" alt="enter image description here"></a></p>
  
  <p>I get Unauthorized and BadRequest responses when tryng to perform Active Scan in ZAP. I tried different user names and ports but it seems that there is some small piece missing in my config. I came across a link on their github page:</p>
  
  <p><a href="https://github.com/zaproxy/zaproxy/issues/1342" rel="nofollow noreferrer">HTTP/1.1 401 Unauthorized</a></p>
  
  <p>but it didn't solve my problem.</p>
  
  <p>How should I set up ZAP to use NTLM authentication? I'm suprised that I was able to set this up <strong>in Postman in 5 minutes</strong>, but in ZAP it took me two days already and still nothing.</p>
  
  <p>Oh, and not to mention that <strong>in C# code it was also 10 minutes of work</strong> using default credentials injected into httpclient through httpclienthandler class:</p>
  
  <pre><code>ICredentials credentials = CredentialCache.DefaultCredentials;
  var clientHandler = new HttpClientHandler()
  {
      Credentials = credentials
  };
  
  var client = new HttpClient(clientHandler);
  var resp = client.GetAsync(new Uri(apiUrl)).Result;
  </code></pre>
  
  <p>Any help appreciated.
  Thank you</p>