if (byteCount > server.encryptionKeyLength) {
                int len = 0;
                // Use appropriate string decoding based on Unicode flag
                try {
                    if ((flags2 & FLAGS2_UNICODE) == FLAGS2_UNICODE) {
                        while (buffer[bufferIndex + len] != (byte) 0x00 || buffer[bufferIndex + len + 1] != (byte) 0x00) {
                            len += 2;

    private void setNegotiatedFlags2(SmbComNegotiateResponse response, int flags2) {
        try {
            Field field = response.getClass().getDeclaredField("negotiatedFlags2");
            field.setAccessible(true);
            field.set(response, flags2);
        } catch (Exception e) {
            throw new RuntimeException("Failed to set negotiatedFlags2 field", e);
        }

   * <p>This method always returns the same object. That object is serializable; deserializing it
   * results in the same object too.
   *
   * @since 14.0 (since 10.0 as {@code DiscreteDomains.longs()})
   */
  public static DiscreteDomain<Long> longs() {
    return LongDomain.INSTANCE;
  }

  private static final class LongDomain extends DiscreteDomain<Long> implements Serializable {

    protected boolean disablePlainTextPasswords = true;
    /** OEM encoding for non-Unicode operations */
    protected String oemEncoding = SmbConstants.DEFAULT_OEM_ENCODING;
    /** SMB flags2 field value */
    protected int flags2 = 0;
    /** SMB client capabilities */
    protected int capabilities = 0;
    /** Maximum number of concurrent SMB sessions */
    protected int sessionLimit = SmbConstants.DEFAULT_SSN_LIMIT;

 * governing permissions and limitations under the License.
 */
package org.codelibs.fess.helper;

import java.security.SecureRandom;
import java.util.Random;

import org.apache.commons.lang3.RandomStringUtils;
import org.codelibs.core.lang.StringUtil;
import org.codelibs.fess.exception.InvalidAccessTokenException;
import org.codelibs.fess.util.ComponentUtil;

import jakarta.servlet.http.HttpServletRequest;

/**

 */
package org.codelibs.fess.mylasta.direction.sponsor;

import java.util.Locale;

import org.apache.commons.lang3.LocaleUtils;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import org.codelibs.core.lang.StringUtil;
import org.codelibs.fess.mylasta.direction.FessConfig;
import org.codelibs.fess.util.ComponentUtil;
import org.dbflute.optional.OptionalObject;

import com.google.common.annotations.GwtIncompatible;
import com.google.common.annotations.J2ktIncompatible;
import com.google.common.base.Preconditions;
import com.google.common.primitives.Ints;
import com.google.common.primitives.Longs;
import com.google.errorprone.annotations.CanIgnoreReturnValue;
import com.google.errorprone.annotations.DoNotCall;
import java.io.DataInput;
import java.io.DataInputStream;
import java.io.EOFException;

        assertEquals((byte) 0x34, dst[1]);
        assertEquals((byte) (0x80 | (NameServicePacket.QUERY << 3) | 0x04 | 0x02 | 0x01), dst[2]); // flags1
        assertEquals((byte) (0x80 | 0x10 | NameServicePacket.FMT_ERR), dst[3]); // flags2
        assertEquals((byte) 0x00, dst[4]); // questionCount
        assertEquals((byte) 0x01, dst[5]);
        assertEquals((byte) 0x00, dst[6]); // answerCount
        assertEquals((byte) 0x02, dst[7]);

        // Setup server data for this scenario
        serverData.capabilities = 0; // No extended security
        serverData.encryptionKeyLength = 8;
        response.flags2 = ServerMessageBlock.FLAGS2_UNICODE;
        byte[] domainNameBytes = "DOMAIN_U".getBytes("UTF-16LE");
        response.byteCount = 8 + domainNameBytes.length + 2; // key + domain + null terminator

#### Die Zeit zum Antworten hilft den Angreifern { #the-time-to-answer-helps-the-attackers }

Wenn die Angreifer zu diesem Zeitpunkt feststellen, dass der Server einige Mikrosekunden länger braucht, um die Response „Incorrect username or password“ zu senden, wissen sie, dass sie _etwas_ richtig gemacht haben, einige der Anfangsbuchstaben waren richtig.