# \[Pentesting\] HTTP auth, part III: rogue web-server

DevFeed: [\[Pentesting\] HTTP auth, part III: rogue web-server](<https://devfeed.tech/articles/pentesting-http-auth-part-iii-rogue-web-server-20541.md>)

Original publisher: [Read original article](<https://yurichev.com/blog/HTTP_auth_3/>)

Published: 2025-11-20T23:00:00Z

Content type: tutorial

Language: en

Sources: [Dennis Yurichev](<https://devfeed.tech/sources/dennis-yurichev.md>)

Topics: [HTTP](<https://devfeed.tech/topics/http.md>), [passwords](<https://devfeed.tech/topics/passwords.md>), [client](<https://devfeed.tech/topics/client.md>), [browser](<https://devfeed.tech/topics/browser.md>)

Tags: [auth](<https://devfeed.tech/tags/auth.md>), [bug](<https://devfeed.tech/tags/bug.md>), [http](<https://devfeed.tech/tags/http.md>), [password](<https://devfeed.tech/tags/password.md>), [tls](<https://devfeed.tech/tags/tls.md>)

## AI overview

This article examines how a rogue web server can downgrade HTTP Digest Authentication to Basic Authentication, allowing an attacker eavesdropping on an unencrypted HTTP connection to obtain a password. It demonstrates the issue with a Python web server and notes that TLS is needed to protect the connection.

## Source excerpt

[Pentesting] HTTP auth, part III: rogue web-server