Hi All,

So I'm trying to use hydra to bruteforce a login on a system that uses custom http headers to receive the username and password. Hydra does not seem to be doing substitution of ^USER^ and ^PASS^ when used as HTTP headers. If I issue issuing a call to hydra like this:

hydra "http-post://0.0.0.0:8000/:H=username\:^USER^:H=password\:^PASS^" -l admin -p admin

I see the following r

I tested on a WP setup I have and when it tries the correct password, the app just closes. Does not save to Result.txt even when I created that textfile in the directory.

Please look into this.

Thanks!

When entering a subnet or IP address for blocking, bfstop should make sure that it the entered string is in a format that represents a valid IP v4 or v6 address or subnet .

There should also be a possibility to add the administrator's own IP address to the whitelist with a single click.

In addition, for subnets it could be useful to show a hint on the subnet that is whitelisted, possibly in