[Pentesting] HTTP auth, part II: digest