Add 8.7 and 8.8 for android and ios: show how you can delay the attacker or report tampering to the backend as a response to a tamper detected
8.7: The app implements multiple mechanisms in each defense category (8.1 to 8.6). Note that resiliency scales with the amount, diversity of the originality of the mechanisms used.
8.8: The detection mechanisms trigger responses of different types, includ

Problem:

URLs are encoded like so:

" " == "%20"

There are many more encodings other than space, this is just one example.

Resources

https://www.w3schools.com/tags/ref_urlencode.ASP
https://www.urlencoder.org/

URL Decoding in Python

https://stackoverflow.com/questions/16566069/url-decode-utf-8-in-python
https://www.urldecoder.io/python/

Guide on how to add thi

Hi All,

So I'm trying to use hydra to bruteforce a login on a system that uses custom http headers to receive the username and password. Hydra does not seem to be doing substitution of ^USER^ and ^PASS^ when used as HTTP headers. If I issue issuing a call to hydra like this:

hydra "http-post://0.0.0.0:8000/:H=username\:^USER^:H=password\:^PASS^" -l admin -p admin

I see the following r

For the sake of the tests below domains.txt contains only "codingo" and wordlist.txt contains only "admin".

When specifying a wordlist, you can specify a variable to fuzz with using:

-w ./wordlist.txt:W1

Where W1 is our insertion point. In addition, FFUF allows you to specify multiple wordlists in a comma delimited fashion. If we put the two together, we have something lik

Would be awesome if it would be possible to save the found streams to a M3U file, compatible with VLC. An example template of a valid M3U file is the following:

#EXTM3U
#EXTINF:-1 tvg-id="" tvg-name="" tvg-language="" tvg-logo="" tvg-country="" tvg-url="" group-title="",[IP AND CHANNELID HERE FOR NAME]
rtsp://192.168.0.5/route/to/stream/here

#EXTINF:-1 tvg-id="" tvg-name="" tvg-langua

Describe the solution you'd like
Progress bars that show progress would be neato

Additional context
https://crates.io/crates/indicatif

so if the password is correct it accepts it .... and if it's wrong it says the entered password is wrong .. and asks for the password again .. just like what the real sites do :)