NTLM

NTLM uses a challenge-response protocol:

• The client sends the username to the server
• The server sends back a random number (i. e. the challenge)
• The client encrypts this number with the hash value of his password and sends this value back to the server
• The server (which has the user's password stored in a database) also encrypts the challenge with the user's password's hash value and compares the response sent back by the client

Thus, the password is not transmitted over the network.

Kerberos is an alternative to NTLM.

Windows authentication

RFC 4559: SPNEGO-based Kerberos and NTLM HTTP Authentication in Microsoft Windows

The --ntlm option of cURL

The member Ntlm of the System.Net.AuthenticationSchemes .NET enum.

SPA (= Secure Password Authentication).

python-ntlm is a Python library that provides NTLM support, including an authentication handler for urllib2