# \[Pentesting\] HTTP auth, part II: digest

DevFeed: [\[Pentesting\] HTTP auth, part II: digest](<https://devfeed.tech/articles/pentesting-http-auth-part-ii-digest-20540.md>)

Original publisher: [Read original article](<https://yurichev.com/blog/HTTP_auth_2/>)

Published: 2025-11-20T23:00:00Z

Content type: article

Language: en

Sources: [Dennis Yurichev](<https://devfeed.tech/sources/dennis-yurichev.md>)

Topics: [HTTP](<https://devfeed.tech/topics/http.md>), [passwords](<https://devfeed.tech/topics/passwords.md>), [TLS (Transport Layer Security)](<https://devfeed.tech/topics/tls.md>), [web browser](<https://devfeed.tech/topics/web-browser.md>)

Tags: [apache](<https://devfeed.tech/tags/apache.md>), [attacks](<https://devfeed.tech/tags/attacks.md>), [browser](<https://devfeed.tech/tags/browser.md>), [code](<https://devfeed.tech/tags/code.md>), [compatibility](<https://devfeed.tech/tags/compatibility.md>), [crack](<https://devfeed.tech/tags/crack.md>), [http](<https://devfeed.tech/tags/http.md>), [legacy](<https://devfeed.tech/tags/legacy.md>), [mitm](<https://devfeed.tech/tags/mitm.md>), [password](<https://devfeed.tech/tags/password.md>), [protection](<https://devfeed.tech/tags/protection.md>), [protocol](<https://devfeed.tech/tags/protocol.md>), [server](<https://devfeed.tech/tags/server.md>), [tls](<https://devfeed.tech/tags/tls.md>), [upgrade](<https://devfeed.tech/tags/upgrade.md>)

## AI overview

The article examines HTTP Digest Authentication, including how the server and browser exchange hashed credentials, how the exchange resists password interception and replay attacks, and how attackers can attempt to crack MD5-based exchanges with hashcat. It notes that Apache 2.4.63 still uses MD5 and recommends upgrading HTTP authentication to TLS.

## Source excerpt

[Pentesting] HTTP auth, part II: digest