The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

46

Chapter 3 

■

Web Application Technologies

70779c03.qxd:WileyRed  9/14/07  3:12 PM  Page 46

---

HTTP Authentication

The HTTP protocol includes its own mechanisms for authenticating users,

using various authentication schemes, including:

■■

Basic — 

This is a very simple authentication mechanism that sends

user credentials as a Base64-encoded string in a request header with

each message.

■■

NTLM — 

This is a challenge-response mechanism and uses a version of

the Windows NTLM protocol.

■■

Digest — 

This is a challenge-response mechanism and uses MD5

checksums of a nonce with the user’s credentials.

It is relatively rare to encounter these authentication protocols being used by

web applications deployed on the Internet, although they are more commonly

used within organizations to access intranet-based services.