understanding NTLM authentication The flow is like this. 


Client sends GET to Server
Server responds with 401 UNAUTHORIZED and the authentication protocol: NTLM
Client re-sends the request including authentication information.




I don't get it. What exactly does the client send at step 3? The password? And if yes, what encoding does it use? The username should be sent in plain text and I don't see it. Here are the HTTP headers:


GET http://example.com 
HTTP/1.1 401 Unauthorized. WWW-Authenticate: Negotiate. WWW-Authenticate: NTLM
GET http://example.com Security: Authorization: Negotiate YIIPQwYGKwYBBQUCoIIPNzCCDzOgMDAuBgkqhki...UMVM=




At step 3 I've cut part of text because it was way too long.
You missed some additional steps and your assumption to pass the username as plain text is not completely right. The whole authentication is done with HTTP headers containing binary messages as Base64.

What you see in step 3 is the negotiation message including host and NT domain in a documented format.

Next the server will respond with a message containing the “challenge” which is a random 8 Byte number. The client will add its own 8 byte random to flummox rogue servers. 

To get authenticated the client has to send the encrypted challenge, knows as the response. The encryption is done using 56-bit DES with it’s MD4 hashed password as key.

The server compares the encrypted challenge with one he created the same way with the password known or passed it to a domain controller for verification.

So the password itself is never transferred.

A more detailed description see NTLM Authentication Scheme for HTTP or at MSDN.