Which of the following protocols is susceptible to replay attack?
Insecure, you just replay $\text{username}$ and $\text{password}$. Password is also sent in clear text.
Secure, if the hash function $H$ used is strong enough to resist bruteforcing of the password. However you'll also need to send the timestamp so that the server can check the auth, so this scheme is better portrayed as $\text{username, timestamp, }H(\text{timestamp}||\text{password})$.
Insecure, you replay $\text{username}$, $\text{timestamp_now}\ $ and $\text{password}$. Password is also sent in clear text.
Insecure, you replay $\text{username}$, $H(\text{timestamp_now})\ $ and $\text{H(password)}$. Password is also sent in clear text.


Make sure to use a secure PBKDF for password hashing, like $scrypt$.