NTLM (NT LAN Manager) is a suite of Microsoft security protocols that provides authentication, integrity, and confidentiality to users.
NTLM has been deprecated for many uses as it doesn't support the latest standards:
Implementers should be aware that NTLM does not support any recent cryptographic methods, such as AES or SHA-256. It uses cyclic redundancy check (CRC) or message digest algorithms (RFC1321) for integrity, and it uses RC4 for encryption. Deriving a key from a password is as specified in RFC1320 and FIPS46-2. Therefore, applications are generally advised not to use NTLM - MSDN and to use Kerberos instead.
Despite this NTLM is still used inside enterprise networks where Microsoft Active Directory provides the enterprise directory service for Integrated Windows Authentication when Kerberos is not available.
NTLM over HTTP handshake is fairly simple:
Request - [unauthenticated - no user info passed]
Response - 401 Unauthorized
WWW-Authenticate: NTLM
Request - Authorization: NTLM <base64-encoded type-1-message>
Response - 401 Unauthorized
WWW-Authenticate: NTLM <base64-encoded type-2-message>
Request - Authorization: NTLM <base64-encoded type-3-message>
Server can now check username/password against LDAP from type-3 message
Response - 200 Ok [now authenticated & authorised]
