# WinRM Basic Auth Detection

- **URL:** https://hackindex.io/services/winrm/vulnerability-discovery/winrm-basic-auth-detection
- **Path:** WinRM > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/winrm/vulnerability-discovery.md)
- **Published:** 2026-03-06
- **Updated:** 2026-03-29

Basic authentication over HTTP on WinRM means credentials are transmitted base64-encoded with no transport protection. Anyone with access to the network path can capture and decode them. This is a direct credential exposure finding, not just a configuration observation. It enables password capture via network interception and can be combined with any technique that sends a login attempt over the channel.

The Microsoft default for the WinRM service has Basic authentication disabled (`False`). When it is enabled, it is almost always a deliberate or misconfigured change. Confirming it is present and active is the goal here.

## Detect Basic Auth from Headers

The fastest check is a raw request to the WSMan endpoint:

```bash
curl -s -D - -o /dev/null http://$TARGET_IP:5985/wsman
# HTTP/1.1 405 Method Not Allowed
# WWW-Authenticate: Negotiate
# WWW-Authenticate: NTLM
# WWW-Authenticate: Basic realm="WSMAN"
# Server: Microsoft-HTTPAPI/2.0
```

`Basic realm="WSMAN"` in the `WWW-Authenticate` header confirms Basic is enabled on the HTTP listener. This is sufficient to document the finding.

Use `http-auth-finder` to get structured output suitable for reporting:

```bash
nmap -Pn -p 5985 --script http-auth-finder $TARGET_IP
# 5985/tcp open  http
# | http-auth-finder:
# |   url                              method
# |_  http://10.10.10.5:5985/wsman    HTTP: Negotiate, NTLM, Basic
```

## Validate That the Service Accepts Basic Credentials

Advertising Basic and actually accepting it are not always the same. If you have valid credentials in scope, confirm the service processes a Basic authentication attempt:

```bash
curl -s -i --basic --user "$USER:$PASSWORD" http://$TARGET_IP:5985/wsman
```

Interpret the response:

- `200` or SOAP fault: the service accepted the Basic credential
- `401` with `Basic` still in `WWW-Authenticate`: wrong credentials, but Basic is enabled
- `401` dropping `Basic` from the header: advertised but not accepted for `/wsman` (rare)

Testing with NTLM for comparison:

```bash
curl -s -i --ntlm --user "$USER:$PASSWORD" http://$TARGET_IP:5985/wsman
```

If both Basic and NTLM succeed, Basic is the priority finding because of the plaintext exposure. If only NTLM succeeds, document WinRM over unencrypted HTTP with NTLM as a separate but lower-severity issue.

## Basic over HTTPS

Basic authentication over HTTPS is not the same finding. TLS provides transport protection, so credentials are not exposed in cleartext. It becomes a concern when the certificate is self-signed, expired, or mismatched, because clients that ignore certificate warnings still receive no real protection. Check the TLS configuration separately if 5986 is open and advertising Basic.

```bash
curl -sk -D - -o /dev/null https://$TARGET_IP:5986/wsman
```

If `Basic` appears here but not on 5985, the risk depends entirely on TLS quality. See the WinRM HTTPS TLS Validation page.

## What AllowUnencrypted Means

Basic over HTTP only works when the WinRM service has `AllowUnencrypted` set to `True`. By default it is `False`, meaning the service requires encrypted transport even when other authentication methods are in use. Finding Basic on HTTP confirms `AllowUnencrypted` is active on this listener, which is the root misconfiguration.

From the target's perspective, this setting is visible in the WinRM configuration:

```bash
winrm get winrm/config/service
```

You cannot run this without access to the target, but the HTTP header confirms the state externally.

## Next Steps

If Basic is confirmed on 5985, the logical follow-on is credential testing via Evil-WinRM or nxc to establish whether valid credentials produce a shell. That is exploitation territory and covered in the WinRM exploitation pages.

## References

- [http-auth-finder NSE Script](https://nmap.org/nsedoc/scripts/http-auth-finder.html) - Detect advertised HTTP authentication methods
- [Windows Remote Management Portal](https://learn.microsoft.com/en-us/windows/win32/winrm/portal) - WSMan and WinRM behavior