Preliminary research

NTLM-Relaying in 2026

Benjamin Floriani and Patrick Pongratz · SecCore GmbH · 18 March 2026

AI-collected research leads through 2 October 2026, including bounded month-by-month reviews of selected social and community sources from March through September. Unranked, incomplete, not community-vetted, and subject to change.

Extends NTLM relay from protocol-specific services to arbitrary HTTP and HTTPS applications. The workflow validates resulting authentication cookies, retains the session, and hands it to an interactive Playwright browser so application-specific post-authentication actions can be performed.

Record

Researcher

Benjamin Floriani and Patrick Pongratz

Published by

SecCore GmbH

Date

18 March 2026

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• WebRelayX

Tags

• ntlm
• relay-attack
• http
• session-cookie
• browser-automation
• tooling

This page is the archive's own catalogue record. The research is the work of Benjamin Floriani and Patrick Pongratz, first published at the original source. Preserved copies are kept so the citation survives its host.