Kali Linux Web Penetration Testing Cookbook - Second Edition

See also

So far, we have seen two authentication methods in web applications, namely, form-based authentication and basic authentication. These are not the only ones used by developers; the reader is encouraged to further investigate advantages, weaknesses, and possible implementation failures in methods such as:

• Digest authentication: This is significantly more secure than basic authentication. Instead of sending the username and password encoded in the header, the client calculates the MD5 hash of a value provided by the server, called a nonce, together with their credentials, and sends this hash to the server, which already knows the nonce, username, and password, and can recalculate the hash and compare both values.
• NTLM/Windows authentication ...