以Matrix的Blog為例，截取其中的認(rèn)證過(guò)程進(jìn)行分析(注意，本文中使用的cookie值已經(jīng)被處理過(guò)，呵呵，別想干壞事握)
測(cè)試環(huán)境：
域：mydomain.com
域主機(jī)：davidturing.mydomain.com
域用戶：davidturing@mydomain.com
代理服務(wù)器：proxyserver.mydomain.com
1） 登陸Windows域（mydomain.com），用戶名為davidturing
2） 打開(kāi)IE窗口，URL=http://www.matrix.org.cn/blog/cas/，由于公司使用了ProxyServer，員工必須通過(guò)ProxyServer才能上網(wǎng)。
于是，IE Client就向Proxyserver請(qǐng)求訪問(wèn)Matrix Blog。
3） Proxy認(rèn)證使用了NTLM，對(duì)IE Client進(jìn)行認(rèn)證。
于是，IE(Client)就和ProxyServer(Server)執(zhí)行下面的三次握手的認(rèn)證過(guò)程。
1: C --> S GET ...
2: C <-- S 401 Unauthorized
WWW-Authenticate: NTLM
3: C --> S GET ...
Authorization: NTLM
4: C <-- S 401 Unauthorized
WWW-Authenticate: NTLM
5: C --> S GET ...
Authorization: NTLM
6: C <-- S 200 Ok
需要指出，NTLM只是兩種Windows認(rèn)證方式中的一種，Kerberos是另外一種，而且更有名，我會(huì)為Kerberos認(rèn)證再寫一篇Blog:)
4） 握手的過(guò)程被我Sniffer了下來(lái)，如下文所示：
/******************
Client->ProxyServer:
******************/
GET http://www.matrix.org.cn/blog/cas HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, application/x-shockwave-flash, */*
Accept-Language: zh-cn,en;q=0.8,zh;q=0.5,zh-tw;q=0.3
Cookie: user=cas%3A%3AAq3HtCAsqNlhY%3A%3A1; matrix_user_cookie=Y2FzfDgzMzM4MURELTk17UStMUU4MS05OTJDLTJERDM4RERGNkUyRg==
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Maxthon; .NET CLR 2.0.50215)
Host: www.matrix.org.cn
Proxy-Connection: Keep-Alive
{分析：注意，這是一個(gè)很簡(jiǎn)單的HTTP GET請(qǐng)求，無(wú)非是想請(qǐng)求www.matrix.org.cn /blog/cas這張頁(yè)面}
/******************
ProxyServer-> Client:
******************/
HTTP/1.1 407 Proxy Authentication Required ( The ISA Server requires authorization to fulfill the request. Access to the Web Proxy service is denied. )
Via:1.1 PROXYSERVER
Proxy-Authenticate: NTLM
Proxy-Authenticate: Kerberos
Proxy-Authenticate: Negotiate
Connection: Keep-Alive
Proxy-Connection: Keep-Alive
Pragma: no-cache
Cache-Control: no-cache
Content-Type: text/html
Content-Length: 2372
．．．．．．返回給客戶端的HTTP實(shí)體，提示頁(yè)面內(nèi)容被省略．．．．．．
{分析：接著，ProxyServer要求我提供認(rèn)證信息，注意，HTTP 407代碼的含義是類似于401，表示客戶必須先經(jīng)過(guò)代理服務(wù)器的授權(quán)。我們還可以看到，Proxy-Authenticate字段里面包含了NTLM,Kerberos，表明可以通過(guò)客戶端來(lái)Negotiate再?zèng)Q定使用兩者中的一種}
/******************
Client->ProxyServer:
******************/
GET http://www.matrix.org.cn/blog/cas HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, application/x-shockwave-flash, */*
Accept-Language: zh-cn,en;q=0.8,zh;q=0.5,zh-tw;q=0.3
Cookie: user=cas%3A%3AAq3HtCAsqNlhY%3A%3A1; matrix_user_cookie=Y2FzfDgzMzM4MURELTk17UStMUU4MS05OTJDLTJERDM4RERGNkUyRg==
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Maxthon; .NET CLR 2.0.50215)
Host: www.matrix.org.cn
Proxy-Connection: Keep-Alive
Proxy-Authorization: NTLM TlRMTVNTUAABAAAAB4IAogAAAAAAAAAAAA
AAAAAAAAAFAJMIAAAAD2==
{分析：
這里，客戶端將自己的NTLM代碼發(fā)送給服務(wù)器，里面包含了一些自己的域帳號(hào)發(fā)送給ProxyServer，ProxyServer就可以知道用戶是誰(shuí)，然后去域服務(wù)器取出用戶的域密碼，加密一個(gè)隨機(jī)字符串去Challenge用戶（見(jiàn)下文）。
在NTLM中，這是三次握手的"第一手"(Type1 Message),目的是Client告訴Server兩樣?xùn)|西：
hoststring:即client的主機(jī)名(比如davidturing)
domainstring：即client在域中的名(比如davidturing.mydomain.com)
Proxy-Authorization的信息結(jié)構(gòu)如下
0 1 2 3
+-------+-------+-------+-------+
0: | 'N' | 'T' | 'L' | 'M' |
+-------+-------+-------+-------+
4: | 'S' | 'S' | 'P' | 0 |
+-------+-------+-------+-------+
8: | 1 | 0 | 0 | 0 |
+-------+-------+-------+-------+
12: | 0x03 | 0xb2 | 0 | 0 |
+-------+-------+-------+-------+
16: | domain length | domain length |
+-------+-------+-------+-------+
20: | domain offset | 0 | 0 |
+-------+-------+-------+-------+
24: | host length | host length |
+-------+-------+-------+-------+
28: | host offset | 0 | 0 |
+-------+-------+-------+-------+
32: | host string |
+ +
. .
. .
+ +-----------------+
| | domain string |
+-------------+ +
. .
. .
[如果數(shù)據(jù)圖顯示的太丑，可以參考：
http://www.innovation.ch/java/ntlm.html
]
由于截取的信息經(jīng)過(guò)BASE64處理,所以，你不可能肉眼從Proxy-Authorization值中判斷出主機(jī)名和主機(jī)域名:)
}
/******************
ProxyServer-> Client:
******************/
HTTP/1.1 407 Proxy Authentication Required ( ¾Ü¾ø•ÃÎÊ¡£ )
Via:1.1 PROXYSERVER
Proxy-Authenticate:
NTLM TlRMTVNTUAACAAAAGAAYADgAAAAFgoGikmfj
JzhsTW0AAAAAAAAAAIoAigBQAAAABQCTCAAA
AA9IAE4ASQBTAEkALgBDAE8ATQAuAEMATgAC
ABgASABOAEkAUwBJAC4AQwBPAE0ALgBDAE4A
AQAWAFAAUgBPAFgAWQBTAEUAUgBWAEUAUgA
EABgAaABuAGkAcwBpAC4AYwBvAG0ALgBjAG4A
AwAwAHAAcgBvAHgAeQBzAGUAcgB2AGUAcgAuA
GgAbgBpAHMAaQAuAGMAbwBtAC4AYwBuAAAAA
AA=
Connection: Keep-Alive
Proxy-Connection: Keep-Alive
Pragma: no-cache
Cache-Control: no-cache
Content-Type: text/html
Content-Length: 0
{分析：這個(gè)步驟中，ProxyServer回應(yīng)我的IE一個(gè)Proxy-Authorization，其值就是上面那段很長(zhǎng)的字符，這是一個(gè)authcode，目的是Chanllenge客戶端(IE)。Chanllenge是對(duì)客戶端的一種身份挑戰(zhàn)，好比方，你說(shuō)你是張三，OK，服務(wù)器用張三的密碼加密一段咚咚，你能告訴服務(wù)器這段咚咚是什么，服務(wù)器就相信你了。
這條type-2 Message是的三次握手的第二握。
0 1 2 3
+-------+-------+-------+-------+
0: | 'N' | 'T' | 'L' | 'M' |
+-------+-------+-------+-------+
4: | 'S' | 'S' | 'P' | 0 |
+-------+-------+-------+-------+
8: | 2 | 0 | 0 | 0 |
+-------+-------+-------+-------+
12: | 0 | 0 | 0 | 0 |
+-------+-------+-------+-------+
16: | message len | 0 | 0 |
+-------+-------+-------+-------+
20: | 0x01 | 0x82 | 0 | 0 |
+-------+-------+-------+-------+
24: | |
+ server nonce |
28: | |
+-------+-------+-------+-------+
32: | 0 | 0 | 0 | 0 |
+-------+-------+-------+-------+
36: | 0 | 0 | 0 | 0 |
+-------+-------+-------+-------+
里面包含了server nounce值，這個(gè)值就是Challenge了。我們需要
根據(jù)這個(gè)8字節(jié)的隨機(jī)數(shù)構(gòu)造type-3 message。
}
/******************
Client->ProxyServer:
******************/
GET http://www.matrix.org.cn/blog/cas HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, application/x-shockwave-flash, */*
Accept-Language: zh-cn,en;q=0.8,zh;q=0.5,zh-tw;q=0.3
Proxy-Authorization:
NTLM TlRMTVNTUAADAAAAGAAYAJIAAAAYABgAqgA
AABgAGABIAAAAGAAYAGAAAAAaABoAeAAAA
AAAAADCAAAABYKAogUAkwgAAAAPaABuAGk
AcwBpAC4AYwBvAG0ALgBjAG4AaAB1AGEAbg
BnAHoAaABhAG8AcQBpAG4ASABVAEEATgBHA
FoASABBAE8AUQBJAE4AMQCGRQ1i+bZleAs2A
kgEXS/CfJ3oOrsi6prctAW2HyADaWwbNqmpO1
Eptq7yJUh4SXd=
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Maxthon; .NET CLR 2.0.50215)
Host: www.matrix.org.cn
Proxy-Connection: Keep-Alive
Cookie: user=cas%3A%3AAq3HtCAsqNlhY%3A%3A1; matrix_user_cookie=Y2FzfDgzMzM4MURELTk17UStMUU4MS05OTJDLTJERDM4RERGNkUyRg==
{分析：OK，這里就是IE客戶端響應(yīng)ProxyServer的Chanllenge，上面的NTLM=TIRMT….就是Challenge回應(yīng)碼，如果這段代碼正確，ProxyServer就承認(rèn)用戶的身份，就可以讓他到訪問(wèn)外網(wǎng)資源。
分析一下這個(gè)type-3 Message，它的結(jié)構(gòu)如下：
0 1 2 3
+-------+-------+-------+-------+
0: | 'N' | 'T' | 'L' | 'M' |
+-------+-------+-------+-------+
4: | 'S' | 'S' | 'P' | 0 |
+-------+-------+-------+-------+
8: | 3 | 0 | 0 | 0 |
+-------+-------+-------+-------+
12: | LM-resp len | LM-Resp len |
+-------+-------+-------+-------+
16: | LM-resp off | 0 | 0 |
+-------+-------+-------+-------+
20: | NT-resp len | NT-Resp len |
+-------+-------+-------+-------+
24: | NT-resp off | 0 | 0 |
+-------+-------+-------+-------+
28: | domain length | domain length |
+-------+-------+-------+-------+
32: | domain offset | 0 | 0 |
+-------+-------+-------+-------+
36: | user length | user length |
+-------+-------+-------+-------+
40: | user offset | 0 | 0 |
+-------+-------+-------+-------+
44: | host length | host length |
+-------+-------+-------+-------+
48: | host offset | 0 | 0 |
+-------+-------+-------+-------+
52: | 0 | 0 | 0 | 0 |
+-------+-------+-------+-------+
56: | message len | 0 | 0 |
+-------+-------+-------+-------+
60: | 0x01 | 0x82 | 0 | 0 |
+-------+-------+-------+-------+
64: | domain string |
+ +
. .
. .
+ +-------------------+
| | user string |
+-----------+ +
. .
. .
+ +-------------+
| | host string |
+-----------------+ +
. .
. .
+ +---------------------------+
| | LanManager-response |
+---+ +
. .
. .
+ +------------------+
| | NT-response |
+------------+ +
. .
. .
+-------+-------+-------+-------+
domain string: 主機(jī)域名(如davidturing.mydomain.com)
user string:用戶名(davidturing)
LanManager-response: 類DES的散列處理
NT-response:MD4散列處理
詳情可參考：
http://samba.kn.vutbr.cz/samba/docs/man/Samba-Developers-Guide/pwencrypt.html
}
/******************
ProxyServer-> Client:
******************/
HTTP/1.1 301 Moved Permanently
Via: 1.1 PROXYSERVER
Connection: Keep-Alive
Proxy-Connection: Keep-Alive
Content-Length: 158
Date: Wed, 21 Sep 2005 03:44:57 GMT
Location: http://www.matrix.org.cn/blog//cas/
Content-Type: text/html
Server: Microsoft-IIS/6.0
Object Moved
This document may be found here
{分析：很明顯，ProxyServer已經(jīng)承認(rèn)了我的身份，并讓我訪問(wèn)Matrix了。這里有一個(gè)小插曲，Matrix做了重定向（熟悉HTTP協(xié)議的人應(yīng)該知道HTTP 301表示move permanetly，即客戶請(qǐng)求的文檔在其他地方，新的URL在Location頭中給出，瀏覽器應(yīng)該自動(dòng)地訪問(wèn)新的URL。）比如，如果我們直接訪問(wèn)http://www.matrix.org.cn/blog//cas/，服務(wù)器會(huì)IE重定向到http://61.142.81.140:9703/blog/cas/，你在頁(yè)面上不會(huì)察覺(jué)到這一點(diǎn)。Chris估計(jì)是想做備份吧？Blog這東西經(jīng)常出問(wèn)題。}
到此，我們已經(jīng)通過(guò)了Proxy認(rèn)證了，下面的通訊的Traffic我就不想說(shuō)了，反正就是先取HTML網(wǎng)頁(yè)，再取網(wǎng)頁(yè)的Style.css，有一個(gè)先后順序，大家不必關(guān)心了。
/******************
Client->ProxyServer:
******************/
GET http://www.matrix.org.cn/blog//cas/ HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, application/x-shockwave-flash, */*
Accept-Language: zh-cn,en;q=0.8,zh;q=0.5,zh-tw;q=0.3
If-Modified-Since: Mon, 19 Sep 2005 03:19:14 GMT
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Maxthon; .NET CLR 2.0.50215)
Host: www.matrix.org.cn
Proxy-Connection: Keep-Alive
If-None-Match: "ea7c9ee9c8bcc51:10a4"
Cookie: user=cas%3A%3AAq3HtCAsqNlhY%3A%3A1; matrix_user_cookie=Y2FzfDgzMzM4MURELTk17UStMUU4MS05OTJDLTJERDM4RERGNkUyRg==
/******************
ProxyServer-> Client:
******************/
HTTP/1.1 200 OK
Via: 1.1 PROXYSERVER
Connection: Keep-Alive
Proxy-Connection: Keep-Alive
Content-Length: 36149
Date: Wed, 21 Sep 2005 03:44:57 GMT
Content-Location: http://www.matrix.org.cn/blog//cas/index.html
Content-Type: text/html
Server: Microsoft-IIS/6.0
Last-Modified: Tue, 20 Sep 2005 14:29:13 GMT
Accept-Ranges: bytes
ETag: "4a5cbacefbdc51:10ce"
．．．．頁(yè)面內(nèi)容被省略．．．．．．．．．
/******************
Client->ProxyServer:
******************/
GET http://www.matrix.org.cn/blog/cas/styles-site.css HTTP/1.0
Accept: */*
Referer: http://www.matrix.org.cn/blog//cas/
Accept-Language: zh-cn,en;q=0.8,zh;q=0.5,zh-tw;q=0.3
Proxy-Connection: Keep-Alive
If-Modified-Since: Sat, 13 Aug 2005 13:23:57 GMT
If-None-Match: "3cea6142aa0c51:10a4"
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Maxthon; .NET CLR 2.0.50215)
Host: www.matrix.org.cn
Cookie: user=cas%3A%3AAq3HtCAsqNlhY%3A%3A1; matrix_user_cookie=Y2FzfDgzMzM4MURELTk17UStMUU4MS05OTJDLTJERDM4RERGNkUyRg==
/******************
ProxyServer-> Client:
******************/
HTTP/1.1 200 OK
Via: 1.1 PROXYSERVER
Connection: Keep-Alive
Proxy-Connection: Keep-Alive
Content-Length: 5379
Date: Wed, 21 Sep 2005 03:44:57 GMT
Content-Type: text/css
Server: Microsoft-IIS/6.0
Last-Modified: Sat, 13 Aug 2005 13:23:57 GMT
Accept-Ranges: bytes
ETag: "3cea6142aa0c51:10ce"
body {
margin:0px 0px 20px 0px;
background:#FFF;
}
A { color: #003366; text-decoration: underline; }
A:link { color: #003366; text-decoration: underline; }
．．．．．styles-site.css內(nèi)容被省略 ．．．．．
padding-right:15px;
padding-top:5px;
padding-bottom:5px;
}