title: Suppress NTLM Auth in Java
body: <p>I am currently pen-testing a web application and came across an interesting phenomenon. During my testing sessions, I gathered URLs using a proxy. Now I wanted to test my URL list for anonymous access, so i wrote this little tool</p>
  
  <pre><code>    public static void main(String[] args) {
      try {
          TrustAllCerts.disableCertChecks();
          FileReader fr = new FileReader(new File("urls.txt"));
          BufferedReader br = new BufferedReader(fr);
  
          String urlStr = br.readLine();
          while (urlStr != null) {
              if (urlStr.trim().length() &gt; 0) {
                  URL url = new URL(urlStr);
  
                  HttpsURLConnection urlc = (HttpsURLConnection) url.openConnection();
                  urlc.connect();
                  if (urlc.getResponseCode() == HttpURLConnection.HTTP_OK) {
                      System.out.println(urlStr);
  
                  } else {
                      System.out.println("["+urlc.getResponseCode()+"] "+urlStr);
                  }
                  urlc.disconnect();
              }
              urlStr = br.readLine();
          }
          br.close();
  
      } catch (Exception e) {
          e.printStackTrace();
      }
  }
  </code></pre>
  
  <p>It does basically nothing, but opening an URL connection on a given URL and test the HTTP response code (actually I implemented some more tests, if I'm getting redirected to a login page). However, the problem is, that this specific application (some custom MS SQL Server Reporting Services) is configured to use NTLM WWW authentication. If I try to access some of the URLs using Firefox, i get an 401 Unauthorized + login dlg. Internet Exploder performs NTLM auth in the background and grants access. It seems that the Java URLConnection (or URL) class does the same, because I am getting no 401. Is there a way to disable implicit NTLM authentication in Java? This is a bad pitfall for me.</p>