# \[Pentesting\] HTTP auth, part I: basic

DevFeed: [\[Pentesting\] HTTP auth, part I: basic](<https://devfeed.tech/articles/pentesting-http-auth-part-i-basic-20539.md>)

Original publisher: [Read original article](<https://yurichev.com/blog/HTTP_auth_1/>)

Published: 2025-11-20T23:00:00Z

Content type: tutorial

Language: en

Sources: [Dennis Yurichev](<https://devfeed.tech/sources/dennis-yurichev.md>)

Topics: [HTTP](<https://devfeed.tech/topics/http.md>), [passwords](<https://devfeed.tech/topics/passwords.md>), [Cryptography](<https://devfeed.tech/topics/cryptography.md>), [openssl](<https://devfeed.tech/topics/openssl.md>)

Tags: [blog-post](<https://devfeed.tech/tags/blog-post.md>), [encryption](<https://devfeed.tech/tags/encryption.md>), [http](<https://devfeed.tech/tags/http.md>), [openssl](<https://devfeed.tech/tags/openssl.md>), [password](<https://devfeed.tech/tags/password.md>)

## AI overview

A pentesting tutorial explains HTTP Basic Authentication setup with htpasswd and .htaccess, showing the credentials exchanged by a browser. It warns that Basic Authentication is weak without TLS because Base64 is only obfuscation, and discusses salted password hashes, hashcat cracking, and OpenSSL support.

## Source excerpt

[Pentesting] HTTP auth, part I: basic