Merge pull request #691 from Schweinepriester/patch-1

README: HTTP => HTTPS
2021-11-07 13:33:26 +01:00 · 2021-11-05 17:47:21 +01:00 · 2021-11-01 14:13:51 +01:00 · 2021-10-27 17:19:13 +02:00 · 2021-10-20 16:29:52 +02:00 · 2021-10-14 10:14:42 +02:00
42 changed files with 598 additions and 378 deletions
@@ -0,0 +1,37 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**IMPORTANT**
+This is just for reporting *BUGS* not help on how to hack, how to use hydra, command line options or how to get it compiled. Please search for help via search engines. Issues asking for this here will be closed.
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+  * Ensure that you have tested the bug to be present in the current github code. You might be using an outdated version that comes with your Linux distribution!
+  * You must provide full command line options.
+
+Steps to reproduce the behavior:
+1. ...
+2. ...
+3. ...
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Screenshots**
+If applicable, add screenshots to help explain your problem.
+Note that all messages must be in *English*, not in Chinese, Russian, etc.
+
+**Desktop (please complete the following information):**
+ - OS: [e.g. Ubuntu 20.04]
+ - hydra version [e.g. current github state]
+
+**Additional context**
+Add any other context about the problem here.
@@ -0,0 +1,23 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**IMPORTANT**
+Please note that hydra is still maintained however not actively developed. If you would like to see specific feature here it it recommended implement it yourself and send a pull request - or look for someone to do that for you :-)
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.
@@ -4,6 +4,9 @@ dist: trusty
 os:
  - linux
  - osx
+arch:
+  - amd64
+  - ppc64le
 compiler:
  - clang
  - gcc
@@ -1,8 +1,26 @@
 Changelog for hydra
 -------------------

-Release 9.1-dev
+Release 9.3-dev
+* support Xcode compilation
+* new module: cobaltstrike by ultimaiiii, thank you!
+* fix for ssh to support -M or ip/range
+* fix for rdp to detect empty passwords
+* for vnc/cisco/... protocols that only check for a password, skip host
+  after the password is found
+* fixe to support IPv6 addresses in -M
+* added "make uninstall"
+
+
+Release 9.2
+* fix for http-post-form optional parameters
 * enable gcc 10 support for xhydra too :)
+* msys support
+* removed rain mode (-r) because of inefficiency
+* IPv6 support for Host: header for http based modules
+
+
+Release 9.1
 * rdb: support for libfreerdp3 (thanks to animetauren)
 * new module: smb2 which also supports smb3 (uses libsmbclient-dev) (thanks to Karim Kanso for the module!)
 * oracle: added success condition (thanks to kazkansouh), compile on Cygwin (thanks to maaaaz)
@@ -6,6 +6,23 @@ you run "./configure":
  Redhat/Fedora:  yum install openssl-devel pcre-devel ncpfs-devel postgresql-devel libssh-devel subversion-devel libncurses-devel
  OpenSuSE:       zypper install libopenssl-devel pcre-devel libidn-devel ncpfs-devel libssh-devel postgresql-devel subversion-devel libncurses-devel

+
+For Termux/Android you need the following setup:
+
+Install the necessary dependencies
+  # pkg install -y x11-repo
+  # pkg install -y clang make openssl openssl-tool wget openssh coreutils gtk2 gtk3
+And then compiling hydra
+  # ./configure --prefix=$PREFIX
+  # make
+  # make install
+
+
+To use xhydra, you will need to install a graphical output in termux, you can be guided from this article:
+
+https://wiki.termux.com/wiki/Graphical_Environment
+
+
 For the Oracle login module, install the basic and SDK packages:
 http://www.oracle.com/technetwork/database/features/instant-client/index.html

@@ -3,3 +3,6 @@ all:

 clean:
 	cp -f Makefile.orig Makefile
+
+uninstall:
+	@echo Error: you must run "./configure" first
@@ -11,6 +11,8 @@ DESTDIR ?=
 BINDIR = /bin
 MANDIR = /man/man1/
 DATADIR = /etc
+PIXDIR = /share/pixmaps
+APPDIR = /share/applications

 SRC = hydra-vnc.c hydra-pcnfs.c hydra-rexec.c hydra-nntp.c hydra-socks5.c \
      hydra-telnet.c hydra-cisco.c hydra-http.c hydra-ftp.c hydra-imap.c \
@@ -23,13 +25,13 @@ SRC = hydra-vnc.c hydra-pcnfs.c hydra-rexec.c hydra-nntp.c hydra-socks5.c \
      hydra-asterisk.c hydra-firebird.c hydra-afp.c hydra-ncp.c hydra-rdp.c \
      hydra-oracle-sid.c hydra-http-proxy.c hydra-http-form.c hydra-irc.c \
      hydra-s7-300.c hydra-redis.c hydra-adam6500.c hydra-rtsp.c \
-      hydra-rpcap.c hydra-radmin2.c \
+      hydra-rpcap.c hydra-radmin2.c hydra-cobaltstrike.c \
      hydra-time.c crc32.c d3des.c bfg.c ntlm.c sasl.c hmacmd5.c hydra-mod.c \
      hydra-smb2.c
 OBJ = hydra-vnc.o hydra-pcnfs.o hydra-rexec.o hydra-nntp.o hydra-socks5.o \
      hydra-telnet.o hydra-cisco.o hydra-http.o hydra-ftp.o hydra-imap.o \
      hydra-pop3.o hydra-smb.o hydra-icq.o hydra-cisco-enable.o hydra-ldap.o \
-      hydra-memcached.o hydra-mongodb.o hydra-mysql.o hydra-mssql.o hydra-xmpp.o \
+      hydra-memcached.o hydra-mongodb.o hydra-mysql.o hydra-mssql.o hydra-cobaltstrike.o hydra-xmpp.o \
      hydra-http-proxy-urlenum.o hydra-snmp.o hydra-cvs.o hydra-smtp.o \
      hydra-smtp-enum.o hydra-sapr3.o hydra-ssh.o hydra-sshkey.o hydra-teamspeak.o \
      hydra-postgres.o hydra-rsh.o hydra-rlogin.o hydra-oracle-listener.o \
@@ -78,8 +80,18 @@ install:	strip
 	-cp -f *.csv $(DESTDIR)$(PREFIX)$(DATADIR)
 	-mkdir -p $(DESTDIR)$(PREFIX)$(MANDIR)
 	-cp -f hydra.1 xhydra.1 pw-inspector.1 $(DESTDIR)$(PREFIX)$(MANDIR)
+	-mkdir -p $(DESTDIR)$(PREFIX)$(PIXDIR)
+	-cp -f xhydra.png $(DESTDIR)$(PREFIX)$(PIXDIR)/
+	-mkdir -p $(DESTDIR)$(PREFIX)$(APPDIR)
+	-desktop-file-install --dir $(DESTDIR)$(PREFIX)$(APPDIR) xhydra.desktop

 clean:
 	rm -rf xhydra pw-inspector hydra *.o core *.core *.stackdump *~ Makefile.in Makefile dev_rfc hydra.restore arm/*.ipk arm/ipkg/usr/bin/* hydra-gtk/src/*.o hydra-gtk/src/xhydra hydra-gtk/stamp-h hydra-gtk/config.status hydra-gtk/errors hydra-gtk/config.log hydra-gtk/src/.deps hydra-gtk/src/Makefile hydra-gtk/Makefile
 	cp -f Makefile.orig Makefile

+uninstall:
+	-rm -f $(DESTDIR)$(PREFIX)$(BINDIR)/xhydra $(DESTDIR)$(PREFIX)$(BINDIR)/hydra $(DESTDIR)$(PREFIX)$(BINDIR)/pw-inspector $(DESTDIR)$(PREFIX)$(BINDIR)/hydra-wizard.sh $(DESTDIR)$(PREFIX)$(BINDIR)/dpl4hydra.sh
+	-rm -f $(DESTDIR)$(PREFIX)$(DATADIR)/dpl4hydra_full.csv $(DESTDIR)$(PREFIX)$(DATADIR)/dpl4hydra_local.csv
+	-rm -f $(DESTDIR)$(PREFIX)$(MANDIR)/hydra.1 $(DESTDIR)$(PREFIX)$(MANDIR)/xhydra.1 $(DESTDIR)$(PREFIX)$(MANDIR)/pw-inspector.1
+	-rm -f $(DESTDIR)$(PREFIX)$(PIXDIR)/xhydra.png
+	-rm -f $(DESTDIR)$(PREFIX)$(APPDIR)/xhydra.desktop
@@ -3,3 +3,6 @@ all:

 clean:
 	cp -f Makefile.orig Makefile
+
+uninstall:
+	@echo Error: you must run "./configure" first
@@ -1,7 +1,7 @@

 				  H Y D R A

-                      (c) 2001-2020 by van Hauser / THC
+                      (c) 2001-2021 by van Hauser / THC
             <vh@thc.org> https://github.com/vanhauser-thc/thc-hydra
       many modules were written by David (dot) Maciejak @ gmail (dot) com
                 BFG code by Jan Dlabal <dlabaljan@gmail.com>
@@ -74,7 +74,7 @@ make install
 ```

 If you want the ssh module, you have to setup libssh (not libssh2!) on your
-system,  get it from http://www.libssh.org, for ssh v1 support you also need
+system,  get it from https://www.libssh.org, for ssh v1 support you also need
 to add "-DWITH_SSH1=On" option in the cmake command line.
 IMPORTANT: If you compile on MacOS then you must do this - do not install libssh via brew!

@@ -382,7 +382,7 @@ Version 1.00 example:
        "These are very free form"
    ],
    "generator": {
-        "built": "2020-03-01 14:44:22",
+        "built": "2021-03-01 14:44:22",
        "commandline": "hydra -b jsonv1 -o results.json ... ...",
        "jsonoutputversion": "1.00",
        "server": "127.0.0.1",
@@ -0,0 +1,2 @@
+title: "thc-hydra" 
+theme: jekyll-theme-midnight
@@ -1,6 +1,5 @@

-/* code original by Jan Dlabal <dlabaljan@gmail.com>, partially rewritten by vh
- */
+/* code original by Jan Dlabal <dlabaljan@gmail.com>, partially rewritten by vh. */

 #include <ctype.h>
 #include <math.h>
@@ -59,7 +58,6 @@ static int32_t add_single_char(char ch, char flags, int32_t *crs_len) {
 // note that we check for -x .:.:ab but not for -x .:.:ba
 //
 int32_t bf_init(char *arg) {
-  bf_options.rain = 0;
  int32_t i = 0;
  int32_t crs_len = 0;
  char flags = 0;
@@ -175,7 +173,9 @@ int32_t bf_init(char *arg) {

  bf_options.crs_len = crs_len;
  bf_options.current = bf_options.from;
+
  memset((char *)bf_options.state, 0, sizeof(bf_options.state));
+
  if (debug)
    printf("[DEBUG] bfg INIT: from %u, to %u, len: %u, set: %s\n", bf_options.from, bf_options.to, bf_options.crs_len, bf_options.crs);

@@ -199,15 +199,7 @@ uint64_t bf_get_pcount() {
  return foo;
 }

-int accu(int value) {
-  int i = 0, a;
-  for (a = 1; a <= value; ++a) {
-    i += a;
-  }
-  return i;
-}
-
-char *bf_next(_Bool rainy) {
+char *bf_next() {
  int32_t i, pos = bf_options.current - 1;

  if (bf_options.current > bf_options.to)
@@ -218,20 +210,9 @@ char *bf_next(_Bool rainy) {
    return NULL;
  }

-  if (rainy) {
-    for (i = 0; i < bf_options.current; i++) {
-      bf_options.ptr[i] = bf_options.crs[(bf_options.state[i] + bf_options.rain) % bf_options.crs_len];
-      bf_options.rain += i + 1;
-    }
-    if (bf_options.crs_len % 10 == 0)
-      bf_options.rain -= accu(bf_options.current) - 2;
-    else if (bf_options.crs_len % 2 == 0)
-      bf_options.rain -= accu(bf_options.current) - 4;
-    else if (bf_options.crs_len % 2)
-      bf_options.rain -= accu(bf_options.current) - 1;
-  } else
-    for (i = 0; i < bf_options.current; i++)
-      bf_options.ptr[i] = bf_options.crs[bf_options.state[i]];
+  for (i = 0; i < bf_options.current; ++i)
+    bf_options.ptr[i] = bf_options.crs[bf_options.state[i]];
+  // we don't subtract the same depending on wether the length is odd or even
  bf_options.ptr[bf_options.current] = 0;

  if (debug) {
@@ -241,12 +222,13 @@ char *bf_next(_Bool rainy) {
    printf(", x: %s\n", bf_options.ptr);
  }

+  // we revert the ordering of the bruteforce to fix the first static character
  while (pos >= 0 && (++bf_options.state[pos]) >= bf_options.crs_len) {
    bf_options.state[pos] = 0;
    pos--;
  }

-  if (pos < 0) {
+  if (pos < 0 || pos >= bf_options.current) {
    bf_options.current++;
    memset((char *)bf_options.state, 0, sizeof(bf_options.state));
  }
@@ -43,7 +43,6 @@ typedef struct {
  char *crs;                        /* internal representation of charset */
  char *ptr;                        /* ptr to the last generated password */
  uint32_t disable_symbols;
-  uint64_t rain; /* accumulator for the rain */
 } bf_option;

 extern bf_option bf_options;
@@ -51,7 +50,7 @@ extern bf_option bf_options;
 #ifdef HAVE_MATH_H
 extern uint64_t bf_get_pcount();
 extern int32_t bf_init(char *arg);
-extern char *bf_next(_Bool rainy);
+extern char *bf_next();
 #endif

 #endif
@@ -17,10 +17,12 @@ if [ "$1" = "-h" -o "$1" = "--help" ]; then
  echo "  --help                     this here"
  echo
  echo If the CC environment variable is set, this is used as the compiler for the configure tests. The default is \"gcc\" otherwise.
+  echo You can also set PKG_CONFIG if necessary.
  exit 0
 fi

 test -z "$CC" && CC=gcc
+test -z "$PKG_CONFIG" && PKG_CONFIG=pkg-config

 FHS=""
 SIXFOUR=""
@@ -157,8 +159,8 @@ fi
 if [ -d "/Library/Developer/CommandLineTools/usr/lib" ]; then
  LIBDIRS="$LIBDIRS /Library/Developer/CommandLineTools/usr/lib /Library/Developer/CommandLineTools/lib"
 fi
-LIBDIRS="$LIBDIRS /lib /usr/lib /usr/local/lib /opt/local/lib"
-INCDIRS="$SDK_PATH/usr/include /usr/local/include /opt/include /opt/local/include"
+LIBDIRS="$LIBDIRS /lib /usr/lib /usr/local/lib /opt/local/lib /mingw64/lib /mingw64/bin"
+INCDIRS="$SDK_PATH/usr/include /usr/local/include /opt/include /opt/local/include /mingw64/include"
 if [ -n "$PREFIX" ]; then
    if [ -d "$PREFIX/lib" ]; then
        LIBDIRS="$LIBDIRS $PREFIX/lib"
@@ -445,7 +447,7 @@ echo "Checking for Postgres (libpq/libpq-fe.h) ..."
  done
  POSTGRES_IPATH=
  for i in $INCDIRS \
-    /opt/p*sql*/include /usr/*p*sql*/include /usr/local/*psql*/include
+    /opt/p*sql*/include /usr/*p*sql*/include /usr/local/*psql*/include /mingw64/include
  do
    if [ "X" = "X$POSTGRES_IPATH" ]; then
        if [ -f "$i/libpq-fe.h" ]; then
@@ -1305,9 +1307,9 @@ echo "Checking for smbclient (libsmbclient/libsmbclient.h) ..."

 if [ "X" = "X$XHYDRA_SUPPORT" ]; then
    echo "Checking for GUI req's (pkg-config/gtk+-2.0) ..."
-  XHYDRA_SUPPORT=`pkg-config --help > /dev/null 2>&1 || echo disabled`
+  XHYDRA_SUPPORT=`$PKG_CONFIG --help > /dev/null 2>&1 || echo disabled`
  if [ "X" = "X$XHYDRA_SUPPORT" ]; then
-     XHYDRA_SUPPORT=`pkg-config --modversion gtk+-2.0 2> /dev/null`
+     XHYDRA_SUPPORT=`$PKG_CONFIG --modversion gtk+-2.0 2> /dev/null`
  else
     XHYDRA_SUPPORT=""
  fi
@@ -1360,6 +1362,10 @@ echo '#include <strings.h>' >> $TMPC.c
 echo "int main() { char *x = strrchr(\"test\", 'e'); if (x == NULL) return 0; else return 1; }" >> $TMPC.c
 $CC -o $TMPC $TMPC.c > /dev/null 2>&1
 test -x $TMPC && STRRCHR=""
+rm -f $TMPC
+$CC -o $TMPC -Wl,--allow-multiple-definition $TMPC.c > /dev/null 2>&1
+WALLOW="no"
+test -x $TMPC && WALLOW="yes"
 rm -f $TMPC $TMPC.c
 echo "                                  ... strrchr()$STRRCHR found"
 if [ -n "$CRYPTO_PATH" ]; then
@@ -1390,6 +1396,11 @@ rm -f $TMPC $TMPC.c $TMPC.c.err
 echo "                                                  Compiling... $GCCSEC"
 echo "                                                  Linking... $LDSEC"

+echo "Checking for --allow-multiple-definition linker option ... $WALLOW"
+if [ "$WALLOW" = "yes" ]; then
+  GCCSECOPT="$GCCSECOPT -Wl,--allow-multiple-definition"
+fi
+
 echo
 XDEFINES=""
 XLIBS=""
@@ -1761,9 +1772,9 @@ cat Makefile.in >> Makefile
 # ignore errors if this uname call fails
 ### Current Cygwin is up to speed :-)
 WINDRES=""
-if [ "$SYSO" = "Cygwin" ]; then
+if [ "$SYSO" = "Cygwin" -o "$SYSO" = "Msys" ]; then
    echo
-    echo "Cygwin detected, if compilation fails just update your installation."
+    echo "Cygwin/MSYS2 detected, if compilation fails just update your installation."
    echo
    WINDRES=`which windres`
    test -x "$WINDRES" && {
@@ -2417,8 +2417,6 @@ draytek,Vigor,all,HTTP,admin,admin,Admin,,
 dreambox,All models,all versions,http, telnet,root,dreambox,,
 dreambox,All models,all versions,http,telnet,root,dreambox,gives access to a busybox allowing to control the box using basic unix commands embedded into busybox,
 drupal.org,Drupal,,administrator,admin,admin,,,
-ducati,Diavel motorcycles,,console,,last 4 digits of the motorcycle's VIN,Start and drive the motorcycle without a key,This is the ignition password - if you have one of these bikes change the password ASAP as you may be liable for any accident damage caused by the thief!,
-ducati,Diavel,,,,Last 4 digits of VIN,,,
 dupont,Digital Water Proofer,,,root,par0t,,,
 dynalink,RTA020,,,admin,private,,,
 dynalink,RTA020,,Admin,admin,private,,,
@@ -3061,7 +3059,6 @@ hewlettpackard,Motive Chorus,,HTTP (port 5060),admin,isee,,,
 hewlettpackard,Officejet,all versions,http,admin,,admin,http interface,
 hewlettpackard,Power Manager,3,HTTP,admin,admin,Admin,,
 hewlettpackard,ProcCurve MSC-5100,,,admin,admin,,,
-hewlettpackard,Remote Insight Board,,,Administrator,The last eight digits of the serial number,,,
 hewlettpackard,StoreOnce,,,HPSupport,badg3r5,,,
 hewlettpackard,Vectra,,Console,,hewlpack,Admin,,
 hewlettpackard,iLo,,http,Admin,Admin,Admin,,
@@ -3611,7 +3608,6 @@ iso sistemi,winwork,,Admin,,,,,
 iwill,PC BIOS,,,,iwill,,,
 iwill,PC BIOS,,Admin,,iwill,,,
 iwill,PC BIOS,,Console,,iwill,Admin,,
-jacksoncommunitycollege,My Network Services,,web,(first 7 letters of student's last name + first seven letters of first name + middle initial -- no spaces or punctuation),(First letter of first name Capitalized + First letter of last name in lowercase + day of birth {01-31} + birth year {2 digits} + last 4 digits of student ID),My Network Services access,,
 jaht,adsl router,AR41/2A,HTTP,admin,epicrouter,Admin,,
 jamfsoftware,Casper Suite,,,jamfsoftware,jamfsw03,,,
 janitza,UMG 508,,,Homepage Password,0th,,,
@@ -3786,7 +3782,6 @@ kyocera,FS3140MFP,,Web Interface,,admin00,Administrator,,
 kyocera,FS6025MFP,,system menus,Admin,Admin,Admin,,
 kyocera,Intermate LAN FS Pro 10/100,K82_0371,HTTP,admin,admin,Admin,,
 kyocera,KM-4850W,,,admin,,,,
-kyocera,KR2,,http,,read notes,,it is the last 6 characters of the mac address,
 kyocera,TASKalfa 250 Ci,,,Admin,admin00,,if enable local authentification,
 kyocera,TASKalfa 250ci,,IP,,admin00,,,
 kyocera,TASKalfa 266ci,,Console Panel,Admin,Admin,Admin,,
@@ -5188,82 +5183,42 @@ oce,tcs500, Windows XP, all models,12.3.0(1668),console, http://192.168.0.81,,
 oce,tcs500,Windows XP,all models,12.3.0(1668),console,http://192.168.0.81,,
 ods,1094 IS Chassis,,,ods,ods,,4.x,
 ods,1094,,,ods,ods,,,
-oki,9600,,,admin,last six characters of the MAC address (letters uppercase).,,,
-oki,B410,,http (dhcp),admin,last six charachter of mac address (upper case),,,
-oki,B410dn,,http://169.254.39.211/,admin,Last 6 characters (chars uppercased) from MAC Address,admin,,
 oki,B411,all ver,Http or AdminManager,root,aaaaaa,Administrator,,
-oki,B420,,http (dhcp),admin,last six charachter of mac address (upper case),,,
-oki,B430,,http (dhcp),admin,last six charachter of mac address (upper case),,,
 oki,B431,all ver,Http or AdminManager,root,aaaaaa,Administrator,,
 oki,B431dn,,http://192.168.1.xxx,root,123456,Admin,,
-oki,B43xx,,,root,(last 6 digits of MAC address),admin,with 8100e(NIC),
 oki,B6100n,,,admin,OkiLAN,admin,with 61e(NIC),
 oki,B6200n,,,admin,OkiLAN,admin,with 62e(NIC),
-oki,B6300,,,root,last six charachter of mac address,root,,
 oki,B6300n,,,admin,OkiLAN,admin,with 62e(NIC),
-oki,B6500,,,root,(last 6 digits of MAC address),root,,
 oki,B710,all,http://192.168.1.33,root,aaaaaa,Administrator,,
 oki,B720,all,http://192.168.1.33,root,aaaaaa,Administrator,,
 oki,B720N,All versions,Web interface,root,aaaaaa,Root access,,
 oki,B730,all,http://192.168.1.33,root,aaaaaa,Administrator,,
 oki,B8300n,,,admin,OkiLAN,admin,with 83e(NIC),
-oki,B930n,,,root,(last 4 digits of MAC address),root,,
-oki,C3200n,,Web Interface - Device IP,root,last 6 of MAC Address - case sensitive,,,
 oki,C330,all versions etc.,http://192.168.0.1,root,aaaaaa,Admin,Administrator,
 oki,C3450,,http://192.168.1.50,admin,heslo,admin,,
-oki,C3450,,web,admin,last 6 digits of MAC code, Use uppercase letters,,
-oki,C3450,,web,admin,last 6 digits of MAC code,Use uppercase letters,Administrator,
-oki,C3530,,console,admin,last 6 digits of MAC address,Admin,,
-oki,C380,,,admin,last 6 characters of the MAC ADRESS,,,
-oki,C51xx,,,root,(last 6 digits of MAC address),admin,with 8100e(NIC),
 oki,C530dn,A1.02,http://192.168.1.51,root,aaaaaa,Admin,,
-oki,C53xx,,,root,(last 6 digits of MAC address),admin,with 8100e(NIC),
-oki,C54xx,,,root,(last 6 digits of MAC address),admin,with 8100e(NIC),
 oki,C5550 MFP,,http,,*blank*,Admin,,
-oki,C5650,,Multi,root,Last 6 characters of MAC address (uppercase),Admin,Last 6 digits are also at the end of the default printer name,
 oki,C5650dn,,,,000000,menu,,
 oki,C5650n,,,,000000,menu,,
-oki,C5700,,HTTP,root,the 6 last digit of the MAC adress,Admin,running with other models,
-oki,C5850,,http,admin,last 6 characters of the MAC ADRESS,,,
-oki,C5900,,HTTP,root,Last 6 characters (chars uppercased) from MAC Address,admin,,
 oki,C6050dn,,,,000000,menu,,
 oki,C6050n,,,,000000,menu,,
 oki,C610,,,admin,aaaaaa,admin,,
-oki,C6100,,HTTP,root,Last 6 characters of MAC address (uppercase),Administrative,seems to work with a variety of oki printers.,
-oki,C6150,N1.01 Network Firmware 08.51,ZeroConFig Bonjour,root,last six characters of MAC address,Basic Setup,Printer ID,Protocol
 oki,C6150dn,,,,000000,menu,,
 oki,C6150dtn,,,,000000,menu,,
 oki,C6150hdn,,,,000000,menu,,
 oki,C6150n,,,,000000,menu,,
 oki,C7000,,,admin,OkiLAN,admin,with 6200e(NIC),
-oki,C7000,,,root,(last 6 digits of MAC address),admin,with 7200e(NIC) or 7300e(NIC),
-oki,C710,All versions,http,root,Last 6 characters (chars uppercased) from MAC Address,Full acces to printer configuration,,
 oki,C711,,Web,admin,aaaaaa,Admin access,,
-oki,C7300,A3.14, may apply to other versions,Multi,root,Last six digits of default device name,,
-oki,C7300,A3.14,may apply to other versions,Multi,root,Last six digits of default device name,Give this a try if the last six digits of the MAC don't work. I believe alpha characters would be uppercased if there were any present.,
-oki,C7350,,Administrator,root,Last 6 characters (chars uppercased) from MAC Address,,,
-oki,C7350,,Multi,root,Last 6 characters (chars uppercased) from MAC Address,Administrator,,
-oki,C810,,http://192.168.0.1,root,Last 6 characters (chars uppercased) from MAC Address,,,
-oki,C821,all version?,HTTP,root,last six charachter of mac address,Admin,,
-oki,C830,all,web,root,last 6 digits of the MAC address,,,
-oki,C8800,,Web or Console,root,Last six characters of MAC address,,,
 oki,C9000,,,admin,OkiLAN,admin,with 6200e(NIC),
-oki,C9000,,,root,(last 6 digits of MAC address),admin,with 7200e(NIC) or 7300e(NIC),
-oki,C9500,,HTTP / telnet,root,Last 6 characters (chars uppercased) from MAC Address,Administration,,
 oki,C9650,,,,0000,Print statistics,,
 oki,C9650,,,,aaaaaa,Administration,,
-oki,C9655,,HTTP,root,last 6 digits of MAC address,Administrator,,
 oki,C9655,,printer menu,,aaaaaa,printer menubutton,,
-oki,C9800,,,root,(last 6 digits of MAC address),,,
-oki,C9850,,,root,(last 6 digits of MAC address),,,
 oki,CX1145,,,,123456,,,
 oki,CX2032 MFP,,http,,*blank*,Admin,,
 oki,CX2033,,Printer Menu,,,,When asked for password just press OK,
 oki,CX2633,,Web interface,admin,aaaaaa,admin,,
 oki,CX2731,,Web interface,admin,aaaaaa,admin,,
-oki,CX3641,,,root,(last 6 digits of MAC address),,,
 oki,Color 8 +14ex,,,admin,OkiLAN,admin,with 6100e(NIC),
-oki,ES3640,,,root,(last 6 digits of MAC address),,,
 oki,ES5460 MFP,,Local configuration menu,,aaaaaa,Admin/Root i guess,,
 oki,ES7120,,Web,root,aaaaaa,Admin,,
 oki,ES7411,,web HTTP,admin,aaaaaa,Administrator,,
@@ -5275,7 +5230,6 @@ oki,MC160,,Op Panel,,000000,Admin,,
 oki,MC160,,Web,,sysAdmin,Admin,,
 oki,MC342w,,,admin,aaaaaa,admin,,
 oki,MC360,,Console,admin,aaaaaa,Full acces to printer configuration,,
-oki,MC360,,HTTP,admin,Last 6 characters (chars uppercased) from MAC Address,Administration,,
 oki,MC361,,Web interface,admin,aaaaaa,admin,,
 oki,MC560,,Printer Menu,,,,When asked for password just press OK,
 oki,MC560,,Printer Menu,,,,When asked for password,
@@ -5285,19 +5239,10 @@ oki,MC860,,Web interface,admin,aaaaaa,admin,,
 oki,ML3xx,,,admin,OkiLAN,admin,with 6010e(NIC),6020e(NIC)
 oki,ML491n,,http://,Admin,OkiLAN,Admin,,
 oki,ML4xx,,,admin,OkiLAN,admin,with 6010e(NIC),6020e(NIC)
-oki,ML8810,,,root,(last 6 digits of MAC address),,,
 oki,N22113B,A2.00,http://192.168.1.9,,noe,Admin,,
 oki,WebTools,,,Administrator,,,,
 oki,b710,all,http://192.168.1.33,root,aaaaaa,Administrator,,
-oki,c3450,All,Multi,admin,last 6 characters of the MAC ADRESS,Admin,,
-oki,c3450,All,Multi,admin,last 6 characters of the MAC ADRESS,Admin,no,
 oki,c511dn,B7.00,,admin,aaaaaa,Full administrator Access,the machine picks up dhcp address,manually configure static on machine directly if required or print a config page to get the dhcp address that was assigned.
-oki,c5300,,,root,last 6 characters of the MAC ADRESS "if it contains any alpha characters type them as upper case",,,
-oki,c5300,,Console,root,last 6 characters of the MAC ADRESS ""if it contains any alpha characters,type them as upper case"",,
-oki,c5300,,Console,root,last 6 characters of the MAC ADRESS "if it contains any alpha characters,type them as upper case",No,
-oki,c5300,,Multi,root,last 6 characters of the MAC ADRESS ""if it contains any alpha characters,type them as upper case"",admin,
-oki,c5300,,Multi,root,last 6 characters of the MAC ADRESS "if it contains any alpha characters,type them as upper case",No,
-oki,c5300,,admin,root,last 6 characters of the MAC ADRESS "if it contains any alpha characters type them as upper case",,,
 oki,c5750,n1.02,http://192.168.0.200,,,,,
 oki,c810,1.0,192.100.185.78,admin,admin,admin,,
 olegkhabarov,Comfy CMS,,,username,password,,,
@@ -10100,7 +10045,6 @@ telus,Telephony and internet services,,,(username),telus12,User,Initial password
 telus,Telephony and internet services,,,(username),telus13,User,Initial password if issued in 2013,
 telus,Telephony and internet services,,,(username),telus99,User,Initial password if issued in 1999,
 tenda,W150M,,192.168.1.1,admin,admin,Admin,,
-teradyne,4TEL,VRS400,DTMF,(last 5 digits of lineman's SSN),(same as user ID),,,
 terayon,,,,admin,nms,,6.29,
 terayon,,Comcast-supplied,HTTP,,,diagnostics page,192.168.100.1/diagnostics_page.html,
 terayon,TeraLink 1000 Controller,,,admin,password,,,
@@ -10403,8 +10347,6 @@ unisys,ClearPath MCP,,Multi,ADMINISTRATOR,ADMINISTRATOR,Admin,,
 unisys,ClearPath MCP,,Multi,HTTP,HTTP,Web Server Administration,,
 unisys,ClearPath MCP,,Multi,NAU,NAU,Privileged,Network Administration Utility,
 unitedtechnologiescorporation,Interlogix truVision IP Camera,,,admin,1234,,,
-universityoftennessee,All Employee and Student Services,,,<NetID> - See Notes,See Notes,Varies with account,Username based on email - eg. if email is smith123@tennessee.edu then NetID (username) is smith123. Def. Password composed of first two letters of birth month in lower case; last two digits of birth; last four digits of UT ID Number; eg. Born Feb 1979 and UT ID Number is 123-45-6789 - default password is fe796789,
-universityoftennessee,All Employee and Student Services,,,lt;NetIDgt; - See Notes,See Notes,Varies with account,Username based on email - eg. if email is smith123@tennessee.edu then NetID (username) is smith123. Def. Password composed of first two letters of birth month in lower case; last two digits of birth; last four digits of UT ID Number; eg. Born Feb 1979 and UT ID Number is 123-45-6789 - default password is fe796789,
 unix,Generic,,,adm,,,,
 unix,Generic,,,adm,adm,,,
 unix,Generic,,,admin,admin,,,
@@ -2417,8 +2417,6 @@ draytek,Vigor,all,HTTP,admin,admin,Admin,,
 dreambox,All models,all versions,http, telnet,root,dreambox,,
 dreambox,All models,all versions,http,telnet,root,dreambox,gives access to a busybox allowing to control the box using basic unix commands embedded into busybox,
 drupal.org,Drupal,,administrator,admin,admin,,,
-ducati,Diavel motorcycles,,console,,last 4 digits of the motorcycle's VIN,Start and drive the motorcycle without a key,This is the ignition password - if you have one of these bikes change the password ASAP as you may be liable for any accident damage caused by the thief!,
-ducati,Diavel,,,,Last 4 digits of VIN,,,
 dupont,Digital Water Proofer,,,root,par0t,,,
 dynalink,RTA020,,,admin,private,,,
 dynalink,RTA020,,Admin,admin,private,,,
@@ -3061,7 +3059,6 @@ hewlettpackard,Motive Chorus,,HTTP (port 5060),admin,isee,,,
 hewlettpackard,Officejet,all versions,http,admin,,admin,http interface,
 hewlettpackard,Power Manager,3,HTTP,admin,admin,Admin,,
 hewlettpackard,ProcCurve MSC-5100,,,admin,admin,,,
-hewlettpackard,Remote Insight Board,,,Administrator,The last eight digits of the serial number,,,
 hewlettpackard,StoreOnce,,,HPSupport,badg3r5,,,
 hewlettpackard,Vectra,,Console,,hewlpack,Admin,,
 hewlettpackard,iLo,,http,Admin,Admin,Admin,,
@@ -3611,7 +3608,6 @@ iso sistemi,winwork,,Admin,,,,,
 iwill,PC BIOS,,,,iwill,,,
 iwill,PC BIOS,,Admin,,iwill,,,
 iwill,PC BIOS,,Console,,iwill,Admin,,
-jacksoncommunitycollege,My Network Services,,web,(first 7 letters of student's last name + first seven letters of first name + middle initial -- no spaces or punctuation),(First letter of first name Capitalized + First letter of last name in lowercase + day of birth {01-31} + birth year {2 digits} + last 4 digits of student ID),My Network Services access,,
 jaht,adsl router,AR41/2A,HTTP,admin,epicrouter,Admin,,
 jamfsoftware,Casper Suite,,,jamfsoftware,jamfsw03,,,
 janitza,UMG 508,,,Homepage Password,0th,,,
@@ -3786,7 +3782,6 @@ kyocera,FS3140MFP,,Web Interface,,admin00,Administrator,,
 kyocera,FS6025MFP,,system menus,Admin,Admin,Admin,,
 kyocera,Intermate LAN FS Pro 10/100,K82_0371,HTTP,admin,admin,Admin,,
 kyocera,KM-4850W,,,admin,,,,
-kyocera,KR2,,http,,read notes,,it is the last 6 characters of the mac address,
 kyocera,TASKalfa 250 Ci,,,Admin,admin00,,if enable local authentification,
 kyocera,TASKalfa 250ci,,IP,,admin00,,,
 kyocera,TASKalfa 266ci,,Console Panel,Admin,Admin,Admin,,
@@ -5188,82 +5183,42 @@ oce,tcs500, Windows XP, all models,12.3.0(1668),console, http://192.168.0.81,,
 oce,tcs500,Windows XP,all models,12.3.0(1668),console,http://192.168.0.81,,
 ods,1094 IS Chassis,,,ods,ods,,4.x,
 ods,1094,,,ods,ods,,,
-oki,9600,,,admin,last six characters of the MAC address (letters uppercase).,,,
-oki,B410,,http (dhcp),admin,last six charachter of mac address (upper case),,,
-oki,B410dn,,http://169.254.39.211/,admin,Last 6 characters (chars uppercased) from MAC Address,admin,,
 oki,B411,all ver,Http or AdminManager,root,aaaaaa,Administrator,,
-oki,B420,,http (dhcp),admin,last six charachter of mac address (upper case),,,
-oki,B430,,http (dhcp),admin,last six charachter of mac address (upper case),,,
 oki,B431,all ver,Http or AdminManager,root,aaaaaa,Administrator,,
 oki,B431dn,,http://192.168.1.xxx,root,123456,Admin,,
-oki,B43xx,,,root,(last 6 digits of MAC address),admin,with 8100e(NIC),
 oki,B6100n,,,admin,OkiLAN,admin,with 61e(NIC),
 oki,B6200n,,,admin,OkiLAN,admin,with 62e(NIC),
-oki,B6300,,,root,last six charachter of mac address,root,,
 oki,B6300n,,,admin,OkiLAN,admin,with 62e(NIC),
-oki,B6500,,,root,(last 6 digits of MAC address),root,,
 oki,B710,all,http://192.168.1.33,root,aaaaaa,Administrator,,
 oki,B720,all,http://192.168.1.33,root,aaaaaa,Administrator,,
 oki,B720N,All versions,Web interface,root,aaaaaa,Root access,,
 oki,B730,all,http://192.168.1.33,root,aaaaaa,Administrator,,
 oki,B8300n,,,admin,OkiLAN,admin,with 83e(NIC),
-oki,B930n,,,root,(last 4 digits of MAC address),root,,
-oki,C3200n,,Web Interface - Device IP,root,last 6 of MAC Address - case sensitive,,,
 oki,C330,all versions etc.,http://192.168.0.1,root,aaaaaa,Admin,Administrator,
 oki,C3450,,http://192.168.1.50,admin,heslo,admin,,
-oki,C3450,,web,admin,last 6 digits of MAC code, Use uppercase letters,,
-oki,C3450,,web,admin,last 6 digits of MAC code,Use uppercase letters,Administrator,
-oki,C3530,,console,admin,last 6 digits of MAC address,Admin,,
-oki,C380,,,admin,last 6 characters of the MAC ADRESS,,,
-oki,C51xx,,,root,(last 6 digits of MAC address),admin,with 8100e(NIC),
 oki,C530dn,A1.02,http://192.168.1.51,root,aaaaaa,Admin,,
-oki,C53xx,,,root,(last 6 digits of MAC address),admin,with 8100e(NIC),
-oki,C54xx,,,root,(last 6 digits of MAC address),admin,with 8100e(NIC),
 oki,C5550 MFP,,http,,*blank*,Admin,,
-oki,C5650,,Multi,root,Last 6 characters of MAC address (uppercase),Admin,Last 6 digits are also at the end of the default printer name,
 oki,C5650dn,,,,000000,menu,,
 oki,C5650n,,,,000000,menu,,
-oki,C5700,,HTTP,root,the 6 last digit of the MAC adress,Admin,running with other models,
-oki,C5850,,http,admin,last 6 characters of the MAC ADRESS,,,
-oki,C5900,,HTTP,root,Last 6 characters (chars uppercased) from MAC Address,admin,,
 oki,C6050dn,,,,000000,menu,,
 oki,C6050n,,,,000000,menu,,
 oki,C610,,,admin,aaaaaa,admin,,
-oki,C6100,,HTTP,root,Last 6 characters of MAC address (uppercase),Administrative,seems to work with a variety of oki printers.,
-oki,C6150,N1.01 Network Firmware 08.51,ZeroConFig Bonjour,root,last six characters of MAC address,Basic Setup,Printer ID,Protocol
 oki,C6150dn,,,,000000,menu,,
 oki,C6150dtn,,,,000000,menu,,
 oki,C6150hdn,,,,000000,menu,,
 oki,C6150n,,,,000000,menu,,
 oki,C7000,,,admin,OkiLAN,admin,with 6200e(NIC),
-oki,C7000,,,root,(last 6 digits of MAC address),admin,with 7200e(NIC) or 7300e(NIC),
-oki,C710,All versions,http,root,Last 6 characters (chars uppercased) from MAC Address,Full acces to printer configuration,,
 oki,C711,,Web,admin,aaaaaa,Admin access,,
-oki,C7300,A3.14, may apply to other versions,Multi,root,Last six digits of default device name,,
-oki,C7300,A3.14,may apply to other versions,Multi,root,Last six digits of default device name,Give this a try if the last six digits of the MAC don't work. I believe alpha characters would be uppercased if there were any present.,
-oki,C7350,,Administrator,root,Last 6 characters (chars uppercased) from MAC Address,,,
-oki,C7350,,Multi,root,Last 6 characters (chars uppercased) from MAC Address,Administrator,,
-oki,C810,,http://192.168.0.1,root,Last 6 characters (chars uppercased) from MAC Address,,,
-oki,C821,all version?,HTTP,root,last six charachter of mac address,Admin,,
-oki,C830,all,web,root,last 6 digits of the MAC address,,,
-oki,C8800,,Web or Console,root,Last six characters of MAC address,,,
 oki,C9000,,,admin,OkiLAN,admin,with 6200e(NIC),
-oki,C9000,,,root,(last 6 digits of MAC address),admin,with 7200e(NIC) or 7300e(NIC),
-oki,C9500,,HTTP / telnet,root,Last 6 characters (chars uppercased) from MAC Address,Administration,,
 oki,C9650,,,,0000,Print statistics,,
 oki,C9650,,,,aaaaaa,Administration,,
-oki,C9655,,HTTP,root,last 6 digits of MAC address,Administrator,,
 oki,C9655,,printer menu,,aaaaaa,printer menubutton,,
-oki,C9800,,,root,(last 6 digits of MAC address),,,
-oki,C9850,,,root,(last 6 digits of MAC address),,,
 oki,CX1145,,,,123456,,,
 oki,CX2032 MFP,,http,,*blank*,Admin,,
 oki,CX2033,,Printer Menu,,,,When asked for password just press OK,
 oki,CX2633,,Web interface,admin,aaaaaa,admin,,
 oki,CX2731,,Web interface,admin,aaaaaa,admin,,
-oki,CX3641,,,root,(last 6 digits of MAC address),,,
 oki,Color 8 +14ex,,,admin,OkiLAN,admin,with 6100e(NIC),
-oki,ES3640,,,root,(last 6 digits of MAC address),,,
 oki,ES5460 MFP,,Local configuration menu,,aaaaaa,Admin/Root i guess,,
 oki,ES7120,,Web,root,aaaaaa,Admin,,
 oki,ES7411,,web HTTP,admin,aaaaaa,Administrator,,
@@ -5275,7 +5230,6 @@ oki,MC160,,Op Panel,,000000,Admin,,
 oki,MC160,,Web,,sysAdmin,Admin,,
 oki,MC342w,,,admin,aaaaaa,admin,,
 oki,MC360,,Console,admin,aaaaaa,Full acces to printer configuration,,
-oki,MC360,,HTTP,admin,Last 6 characters (chars uppercased) from MAC Address,Administration,,
 oki,MC361,,Web interface,admin,aaaaaa,admin,,
 oki,MC560,,Printer Menu,,,,When asked for password just press OK,
 oki,MC560,,Printer Menu,,,,When asked for password,
@@ -5285,19 +5239,10 @@ oki,MC860,,Web interface,admin,aaaaaa,admin,,
 oki,ML3xx,,,admin,OkiLAN,admin,with 6010e(NIC),6020e(NIC)
 oki,ML491n,,http://,Admin,OkiLAN,Admin,,
 oki,ML4xx,,,admin,OkiLAN,admin,with 6010e(NIC),6020e(NIC)
-oki,ML8810,,,root,(last 6 digits of MAC address),,,
 oki,N22113B,A2.00,http://192.168.1.9,,noe,Admin,,
 oki,WebTools,,,Administrator,,,,
 oki,b710,all,http://192.168.1.33,root,aaaaaa,Administrator,,
-oki,c3450,All,Multi,admin,last 6 characters of the MAC ADRESS,Admin,,
-oki,c3450,All,Multi,admin,last 6 characters of the MAC ADRESS,Admin,no,
 oki,c511dn,B7.00,,admin,aaaaaa,Full administrator Access,the machine picks up dhcp address,manually configure static on machine directly if required or print a config page to get the dhcp address that was assigned.
-oki,c5300,,,root,last 6 characters of the MAC ADRESS "if it contains any alpha characters type them as upper case",,,
-oki,c5300,,Console,root,last 6 characters of the MAC ADRESS ""if it contains any alpha characters,type them as upper case"",,
-oki,c5300,,Console,root,last 6 characters of the MAC ADRESS "if it contains any alpha characters,type them as upper case",No,
-oki,c5300,,Multi,root,last 6 characters of the MAC ADRESS ""if it contains any alpha characters,type them as upper case"",admin,
-oki,c5300,,Multi,root,last 6 characters of the MAC ADRESS "if it contains any alpha characters,type them as upper case",No,
-oki,c5300,,admin,root,last 6 characters of the MAC ADRESS "if it contains any alpha characters type them as upper case",,,
 oki,c5750,n1.02,http://192.168.0.200,,,,,
 oki,c810,1.0,192.100.185.78,admin,admin,admin,,
 olegkhabarov,Comfy CMS,,,username,password,,,
@@ -10100,7 +10045,6 @@ telus,Telephony and internet services,,,(username),telus12,User,Initial password
 telus,Telephony and internet services,,,(username),telus13,User,Initial password if issued in 2013,
 telus,Telephony and internet services,,,(username),telus99,User,Initial password if issued in 1999,
 tenda,W150M,,192.168.1.1,admin,admin,Admin,,
-teradyne,4TEL,VRS400,DTMF,(last 5 digits of lineman's SSN),(same as user ID),,,
 terayon,,,,admin,nms,,6.29,
 terayon,,Comcast-supplied,HTTP,,,diagnostics page,192.168.100.1/diagnostics_page.html,
 terayon,TeraLink 1000 Controller,,,admin,password,,,
@@ -10403,8 +10347,6 @@ unisys,ClearPath MCP,,Multi,ADMINISTRATOR,ADMINISTRATOR,Admin,,
 unisys,ClearPath MCP,,Multi,HTTP,HTTP,Web Server Administration,,
 unisys,ClearPath MCP,,Multi,NAU,NAU,Privileged,Network Administration Utility,
 unitedtechnologiescorporation,Interlogix truVision IP Camera,,,admin,1234,,,
-universityoftennessee,All Employee and Student Services,,,<NetID> - See Notes,See Notes,Varies with account,Username based on email - eg. if email is smith123@tennessee.edu then NetID (username) is smith123. Def. Password composed of first two letters of birth month in lower case; last two digits of birth; last four digits of UT ID Number; eg. Born Feb 1979 and UT ID Number is 123-45-6789 - default password is fe796789,
-universityoftennessee,All Employee and Student Services,,,lt;NetIDgt; - See Notes,See Notes,Varies with account,Username based on email - eg. if email is smith123@tennessee.edu then NetID (username) is smith123. Def. Password composed of first two letters of birth month in lower case; last two digits of birth; last four digits of UT ID Number; eg. Born Feb 1979 and UT ID Number is 123-45-6789 - default password is fe796789,
 unix,Generic,,,adm,,,,
 unix,Generic,,,adm,adm,,,
 unix,Generic,,,admin,admin,,,
@@ -5,7 +5,7 @@
 #endif

 extern char *HYDRA_EXIT;
-char *buf = NULL;
+static char *buf = NULL;

 int32_t start_cisco(int32_t s, char *ip, int32_t port, unsigned char options, char *miscptr, FILE *fp) {
  char *empty = "";
@@ -0,0 +1,126 @@
+#include "hydra-mod.h"
+
+#define CSLEN 256
+
+extern char *HYDRA_EXIT;
+char *buf;
+
+int32_t start_cobaltstrike(int32_t s, char *ip, int32_t port, unsigned char options, char *miscptr, FILE *fp) {
+  char *empty = "";
+  char *pass, buffer[4 + 1 + 256];
+  char cs_pass[CSLEN + 1];
+  unsigned char len_pass;
+  unsigned char reply_byte_0;
+  unsigned char reply_byte_1;
+  unsigned char reply_byte_2;
+  unsigned char reply_byte_3;
+  int32_t ret = -1;
+
+  if (strlen(pass = hydra_get_next_password()) == 0)
+    pass = empty;
+  if (strlen(pass) > CSLEN)
+    pass[CSLEN - 1] = 0;
+  len_pass = strlen(pass);
+  memset(cs_pass, 0, CSLEN + 1);
+  strcpy(cs_pass, pass);
+
+  memset(buffer, 0x41, sizeof(buffer));
+  buffer[0] = 0x00;
+  buffer[1] = 0x00;
+  buffer[2] = 0xBE;
+  buffer[3] = 0xEF;
+  memcpy(buffer + 4, &len_pass, 1);
+  memcpy(buffer + 5, cs_pass, len_pass);
+
+  if (hydra_send(s, buffer, sizeof(buffer), 0) < 0)
+    return 1;
+
+  reply_byte_0 = 0x00;
+  ret = hydra_recv_nb(s, &reply_byte_0, 1);
+  if (ret <= 0)
+    return 3;
+
+  reply_byte_1 = 0x00;
+  ret = hydra_recv_nb(s, &reply_byte_1, 1);
+  if (ret <= 0)
+    return 3;
+
+  reply_byte_2 = 0x00;
+  ret = hydra_recv_nb(s, &reply_byte_2, 1);
+  if (ret <= 0)
+    return 3;
+
+  reply_byte_3 = 0x00;
+  ret = hydra_recv_nb(s, &reply_byte_3, 1);
+  if (ret <= 0)
+    return 3;
+
+  if (reply_byte_0 == 0x00 && reply_byte_1 == 0x00 && reply_byte_2 == 0xCA && reply_byte_3 == 0xFE) {
+    hydra_report_found_host(port, ip, "cobaltstrike", fp);
+    hydra_completed_pair_found();
+    free(buf);
+    if (memcmp(hydra_get_next_pair(), &HYDRA_EXIT, sizeof(HYDRA_EXIT)) == 0)
+      return 2;
+    return 1;
+  }
+
+  free(buf);
+  hydra_completed_pair();
+  if (memcmp(hydra_get_next_pair(), &HYDRA_EXIT, sizeof(HYDRA_EXIT)) == 0)
+    return 2;
+
+  return 1;
+}
+
+void service_cobaltstrike(char *ip, int32_t sp, unsigned char options, char *miscptr, FILE *fp, int32_t port, char *hostname) {
+  int32_t run = 1, next_run = 1, sock = -1;
+  int32_t mysslport = PORT_COBALTSTRIKE_SSL;
+
+  hydra_register_socket(sp);
+  if (memcmp(hydra_get_next_pair(), &HYDRA_EXIT, sizeof(HYDRA_EXIT)) == 0)
+    return;
+  while (1) {
+    switch (run) {
+    case 1: /* connect and service init function */
+      if (port != 0)
+        mysslport = port;
+      sock = hydra_connect_ssl(ip, mysslport, hostname);
+      port = mysslport;
+      if (sock < 0) {
+        hydra_report(stderr, "[ERROR] Child with pid %d terminating, can not connect\n", (int32_t)getpid());
+        hydra_child_exit(1);
+      }
+      next_run = start_cobaltstrike(sock, ip, port, options, miscptr, fp);
+      hydra_disconnect(sock);
+      break;
+    case 2: /* clean exit */
+      if (sock >= 0)
+        sock = hydra_disconnect(sock);
+      hydra_child_exit(0);
+      return;
+    case 3: /* clean exit */
+      if (sock >= 0)
+        sock = hydra_disconnect(sock);
+      hydra_child_exit(2);
+      return;
+    default:
+      hydra_report(stderr, "[ERROR] Caught unknown return code, exiting!\n");
+      hydra_child_exit(2);
+    }
+    run = next_run;
+  }
+}
+
+int32_t service_cobaltstrike_init(char *ip, int32_t sp, unsigned char options, char *miscptr, FILE *fp, int32_t port, char *hostname) {
+  // called before the childrens are forked off, so this is the function
+  // which should be filled if initial connections and service setup has to be
+  // performed once only.
+  //
+  // fill if needed.
+  //
+  // return codes:
+  //   0 all OK
+  //   -1  error, hydra will exit, so print a good error message here
+
+  return 0;
+}
@@ -62,7 +62,8 @@ MAINT = @MAINT@
 MAKEINFO = @MAKEINFO@
 PACKAGE = @PACKAGE@
 PACKAGE_CFLAGS = @PACKAGE_CFLAGS@ -fcommon -Wl,--allow-multiple-definition
-PACKAGE_LIBS = @PACKAGE_LIBS@
+PACKAGE_LDFLAGS = -fcommon -Wl,--allow-multiple-definition
+PACKAGE_LIBS = -fcommon -Wl,--allow-multiple-definition @PACKAGE_LIBS@
 PKG_CONFIG = @PKG_CONFIG@
 VERSION = @VERSION@

@@ -62,7 +62,7 @@ MAINT = @MAINT@
 MAKEINFO = @MAKEINFO@
 PACKAGE = @PACKAGE@
 PACKAGE_CFLAGS = @PACKAGE_CFLAGS@ -fcommon -Wl,--allow-multiple-definition
-PACKAGE_LIBS = @PACKAGE_LIBS@
+PACKAGE_LIBS = -fcommon -Wl,--allow-multiple-definition @PACKAGE_LIBS@
 PKG_CONFIG = @PKG_CONFIG@
 VERSION = @VERSION@

@@ -18,8 +18,11 @@ char *hydra_path1 = "./hydra";
 char *hydra_path2 = "/usr/local/bin/hydra";
 char *hydra_path3 = "/usr/bin/hydra";

+GtkWidget *wndMain;
+char *HYDRA_BIN;
+guint message_id;
+
 int main(int argc, char *argv[]) {
-  extern GtkWidget *wndMain;
  int i;
  extern guint message_id;
  GtkWidget *output;
@@ -37,6 +37,6 @@ GdkPixbuf *create_pixbuf(const gchar *filename);
 /* This is used to set ATK action descriptions. */
 void glade_set_atk_action_description(AtkAction *action, const gchar *action_name, const gchar *description);

-GtkWidget *wndMain;
-char *HYDRA_BIN;
-guint message_id;
+extern GtkWidget *wndMain;
+extern char *HYDRA_BIN;
+extern guint message_id;
@@ -78,7 +78,7 @@ int32_t auth_flag = 0;

 char cookie[4096] = "", cmiscptr[1024];

-int32_t webport, freemischttpform = 0;
+int32_t webport;
 char bufferurl[6096 + 24], cookieurl[6096 + 24] = "", userheader[6096 + 24] = "", *url, *variables, *optional1;

 #define MAX_REDIRECT 8
@@ -400,6 +400,10 @@ int32_t parse_options(char *miscptr, ptr_header_node *ptr_head) {
   * Beware of the backslashes (\)!
   */
  while (*miscptr != 0) {
+    if (strlen(miscptr) < 3 || miscptr[1] != '=') {
+      hydra_report(stderr, "[ERROR] optional parameters must have the format X=value: %s\n", miscptr);
+      return 0;
+    }
    switch (miscptr[0]) {
    case 'a': // fall through
    case 'A': // only for http, not http-form!
@@ -504,7 +508,9 @@ int32_t parse_options(char *miscptr, ptr_header_node *ptr_head) {
      // Error: abort execution
      hydra_report(stderr, "[ERROR] Out of memory for HTTP headers (H).\n");
      return 0;
-      // no default
+    default:
+      hydra_report(stderr, "[ERROR] no valid optional parameter type given: %c\n", miscptr[0]);
+      return 0;
    }
  }
  return 1;
@@ -566,16 +572,18 @@ char *html_encode(char *string) {
  if (ret == NULL)
    return NULL;

-  if (index(ret, '%') != NULL)
+  if (strchr(ret, '%') != NULL)
    ret = hydra_strrep(ret, "%", "%25");
-  if (index(ret, ' ') != NULL)
+  if (strchr(ret, ' ') != NULL)
    ret = hydra_strrep(ret, " ", "%20");
-  if (index(ret, '&') != NULL)
+  if (strchr(ret, '&') != NULL)
    ret = hydra_strrep(ret, "&", "%26");
-  if (index(ret, '#') != NULL)
+  if (strchr(ret, '#') != NULL)
    ret = hydra_strrep(ret, "#", "%23");
-  if (index(ret, '=') != NULL)
+  if (strchr(ret, '=') != NULL)
    ret = hydra_strrep(ret, "=", "%3D");
+  if (strchr(ret, '+') != NULL)
+    ret = hydra_strrep(ret, "+", "%2B");

  return ret;
 }
@@ -638,10 +646,10 @@ int32_t analyze_server_response(int32_t s) {
        } else if (endcookie2 != NULL)
          *endcookie2 = 0;
        // is the cookie already there? if yes, remove it!
-        if (index(startcookie, '=') != NULL && (ptr = index(startcookie, '=')) - startcookie + 1 <= sizeof(tmpname)) {
+        if (strchr(startcookie, '=') != NULL && (ptr = strchr(startcookie, '=')) - startcookie + 1 <= sizeof(tmpname)) {
          strncpy(tmpname, startcookie, sizeof(tmpname) - 2);
          tmpname[sizeof(tmpname) - 2] = 0;
-          ptr = index(tmpname, '=');
+          ptr = strchr(tmpname, '=');
          *(++ptr) = 0;
          // is the cookie already in the cookiejar? (so, does it have to be
          // replaced?)
@@ -667,7 +675,7 @@ int32_t analyze_server_response(int32_t s) {
            strcpy(cookie, tmpcookie);
          }
        }
-        ptr = index(str, '=');
+        ptr = strchr(str, '=');
        // only copy the cookie if it has a value (otherwise the server wants to
        // delete the cookie)
        if (ptr != NULL && *(ptr + 1) != ';' && *(ptr + 1) != 0 && *(ptr + 1) != '\n' && *(ptr + 1) != '\r') {
@@ -1031,7 +1039,7 @@ int32_t start_http_form(int32_t s, char *ip, int32_t port, unsigned char options
      }

      if (strrchr(url, ':') == NULL && port != 80) {
-        sprintf(str2, "%s:%d", str2, port);
+        sprintf(str2, "%.2040s:%d", str2, port);
      }

      if (verbose)
@@ -1125,9 +1133,6 @@ void service_http_form(char *ip, int32_t sp, unsigned char options, char *miscpt
  while (1) {
    if (run == 2) {
      if (memcmp(hydra_get_next_pair(), &HYDRA_EXIT, sizeof(HYDRA_EXIT)) == 0) {
-        if (freemischttpform)
-          free(miscptr);
-        freemischttpform = 0;
        hydra_child_exit(1);
      }
    }
@@ -1149,9 +1154,6 @@ void service_http_form(char *ip, int32_t sp, unsigned char options, char *miscpt
      }
      if (sock < 0) {
        hydra_report(stderr, "[ERROR] Child with pid %d terminating, cannot connect\n", (int32_t)getpid());
-        if (freemischttpform)
-          free(miscptr);
-        freemischttpform = 0;
        hydra_child_exit(1);
      }
      next_run = 2;
@@ -1163,30 +1165,19 @@ void service_http_form(char *ip, int32_t sp, unsigned char options, char *miscpt
    case 3: /* clean exit */
      if (sock >= 0)
        sock = hydra_disconnect(sock);
-      if (freemischttpform)
-        free(miscptr);
-      freemischttpform = 0;
      hydra_child_exit(0);
      break;
    case 4: /* silent error exit */
      if (sock >= 0)
        sock = hydra_disconnect(sock);
-      if (freemischttpform)
-        free(miscptr);
-      freemischttpform = 0;
      hydra_child_exit(1);
      break;
    default:
-      if (freemischttpform)
-        free(miscptr);
-      freemischttpform = 0;
      hydra_report(stderr, "[ERROR] Caught unknown return code, exiting!\n");
      hydra_child_exit(0);
    }
    run = next_run;
  }
-  if (freemischttpform)
-    free(miscptr);
 }

 void service_http_get_form(char *ip, int32_t sp, unsigned char options, char *miscptr, FILE *fp, int32_t port, char *hostname) {
@@ -1197,7 +1188,7 @@ void service_http_get_form(char *ip, int32_t sp, unsigned char options, char *mi
    service_http_form(ip, sp, options, miscptr, fp, port, hostname, "GET", &ptr_head, &ptr_cookie);
  else {
    hydra_report(stderr, "[ERROR] Could not launch head. Error while initializing.\n");
-    hydra_child_exit(1);
+    hydra_child_exit(2);
  }
 }

@@ -1209,7 +1200,7 @@ void service_http_post_form(char *ip, int32_t sp, unsigned char options, char *m
    service_http_form(ip, sp, options, miscptr, fp, port, hostname, "POST", &ptr_head, &ptr_cookie);
  else {
    hydra_report(stderr, "[ERROR] Could not launch head. Error while initializing.\n");
-    hydra_child_exit(1);
+    hydra_child_exit(2);
  }
 }

@@ -1224,41 +1215,30 @@ int32_t service_http_form_init(char *ip, int32_t sp, unsigned char options, char
  //   0 all OK
  //   -1  error, hydra will exit, so print a good error message here

+  if (initialize(ip, options, miscptr) == NULL)
+    return 1;
+
  return 0;
 }

 ptr_header_node initialize(char *ip, unsigned char options, char *miscptr) {
  ptr_header_node ptr_head = NULL;
  char *ptr, *ptr2, *proxy_string;
+#ifdef AF_INET6
+  unsigned char addr6[sizeof(struct in6_addr)];
+#endif

  if (use_proxy > 0 && proxy_count > 0)
    selected_proxy = random() % proxy_count;

-  if (webtarget != NULL && (webtarget = strstr(miscptr, "://")) != NULL) {
-    webtarget += strlen("://");
-    if ((ptr2 = index(webtarget, ':')) != NULL) { /* step over port if present */
-      *ptr2 = 0;
-      ptr2++;
-      ptr = ptr2;
-      if (*ptr == '/' || (ptr = index(ptr2, '/')) != NULL)
-        miscptr = ptr;
-      else
-        miscptr = slash; /* to make things easier to user */
-    } else if ((ptr2 = index(webtarget, '/')) != NULL) {
-      if (freemischttpform == 0) {
-        if ((miscptr = malloc(strlen(ptr2) + 1)) != NULL) {
-          freemischttpform = 1;
-          strcpy(miscptr, ptr2);
-          *ptr2 = 0;
-        }
-      }
-    } else
-      webtarget = NULL;
+  if (webtarget) {
+    free(webtarget);
+    webtarget = NULL;
  }

-  if (cmdlinetarget != NULL && webtarget == NULL)
+  if (cmdlinetarget != NULL)
    webtarget = cmdlinetarget;
-  else if (webtarget == NULL && cmdlinetarget == NULL)
+  else
    webtarget = hydra_address2string(ip);
  if (port != 0)
    webport = port;
@@ -1267,6 +1247,28 @@ ptr_header_node initialize(char *ip, unsigned char options, char *miscptr) {
  else
    webport = PORT_HTTP_SSL;

+  /* normalise the webtarget for ipv6/port number */
+  ptr = malloc(strlen(webtarget) + 1 /* null */ + 6 /* :65535  */
+#ifdef AF_INET6
+               + 2 /* [] */
+#endif
+  );
+#ifdef AF_INET6
+  /* let libc decide if target is an ipv6 address */
+  if (inet_pton(AF_INET6, webtarget, addr6)) {
+    ptr2 = ptr + sprintf(ptr, "[%s]", webtarget);
+  } else {
+#endif
+    ptr2 = ptr + sprintf(ptr, "%s", webtarget);
+#ifdef AF_INET6
+  }
+#endif
+  if (options & OPTION_SSL && webport != PORT_HTTP_SSL || !(options & OPTION_SSL) && webport != PORT_HTTP) {
+    sprintf(ptr2, ":%d", webport);
+  }
+  webtarget = ptr;
+  ptr = ptr2 = NULL;
+
  sprintf(bufferurl, "%.6096s", miscptr);
  url = bufferurl;
  ptr = url;
@@ -1282,21 +1284,16 @@ ptr_header_node initialize(char *ip, unsigned char options, char *miscptr) {
  if (*ptr != 0)
    *ptr++ = 0;

-  if ((ptr2 = rindex(ptr, ':')) != NULL) {
-    cond = ptr2 + 1;
-    *ptr2 = 0;
+  cond = ptr;
+
+  if ((ptr2 = strchr(ptr, ':')) != NULL) {
+    *ptr2++ = 0;
+    if (*ptr2)
+      optional1 = ptr2;
+    else
+      optional1 = NULL;
  } else
-    cond = ptr;
-  /*
-    while (*ptr != 0 && (*ptr != ':' || *(ptr - 1) == '\\'))
-      ptr++;
-    if (*ptr != 0)
-      *ptr++ = 0;
-  */
-  if (ptr == cond)
    optional1 = NULL;
-  else
-    optional1 = ptr;

  if (strstr(url, "\\:") != NULL) {
    if ((ptr = malloc(strlen(url))) != NULL) {
@@ -1332,7 +1329,7 @@ ptr_header_node initialize(char *ip, unsigned char options, char *miscptr) {
  sprintf(cookieurl, "%.1000s", url);

  // conditions now have to contain F or S to set the fail or success condition
-  if (*cond != 0 && (strpos(cond, "F=") == 0)) {
+  if (strpos(cond, "F=") == 0) {
    success_cond = 0;
    cond += 2;
  } else if (*cond != 0 && (strpos(cond, "S=") == 0)) {
@@ -1407,6 +1404,7 @@ ptr_header_node initialize(char *ip, unsigned char options, char *miscptr) {
      normal_request = stringify_headers(&ptr_head);
    }
  }
+
  return ptr_head;
 }

@@ -28,17 +28,17 @@ int32_t start_http_proxy_urlenum(int32_t s, char *ip, int32_t port, unsigned cha
    ptr++;
  strncpy(mhost, ptr, sizeof(mhost) - 1);
  mhost[sizeof(mhost) - 1] = 0;
-  if ((ptr = index(mhost, '/')) != NULL)
+  if ((ptr = strchr(mhost, '/')) != NULL)
    *ptr = 0;
-  if ((ptr = index(mhost, ']')) != NULL)
+  if ((ptr = strchr(mhost, ']')) != NULL)
    *ptr = 0;
-  else if ((ptr = index(mhost, ':')) != NULL)
+  else if ((ptr = strchr(mhost, ':')) != NULL)
    *ptr = 0;

-  if (miscptr != NULL && index(miscptr, ':') != NULL) {
+  if (miscptr != NULL && strchr(miscptr, ':') != NULL) {
    strncpy(mlogin, miscptr, sizeof(mlogin) - 1);
    mlogin[sizeof(mlogin) - 1] = 0;
-    ptr = index(mlogin, ':');
+    ptr = strchr(mlogin, ':');
    *ptr++ = 0;
    strncpy(mpass, ptr, sizeof(mpass) - 1);
    mpass[sizeof(mpass) - 1] = 0;
@@ -215,7 +215,7 @@ int32_t start_http_proxy_urlenum(int32_t s, char *ip, int32_t port, unsigned cha
    }
  }
  // result analysis
-  ptr = ((char *)index(buf, ' ')) + 1;
+  ptr = ((char *)strchr(buf, ' ')) + 1;
  if (*ptr == '2' || (*ptr == '3' && (*(ptr + 2) == '1' || *(ptr + 2) == '2')) || strncmp(ptr, "404", 4) == 0 || strncmp(ptr, "403", 4) == 0) {
    hydra_report_found_host(port, ip, "http-proxy", fp);
    if (fp != stdout)
@@ -24,9 +24,9 @@ int32_t start_http_proxy(int32_t s, char *ip, int32_t port, unsigned char option
    sprintf(url, "%.500s", miscptr);
    ptr = strstr(miscptr, "://"); // :// check is in hydra.c
    sprintf(host, "Host: %.50s", ptr + 3);
-    if ((ptr = index(host, '/')) != NULL)
+    if ((ptr = strchr(host, '/')) != NULL)
      *ptr = 0;
-    if ((ptr = index(host + 6, ':')) != NULL && host[0] != '[')
+    if ((ptr = strchr(host + 6, ':')) != NULL && host[0] != '[')
      *ptr = 0;
    strcat(host, "\r\n");
  }
@@ -51,15 +51,10 @@ int32_t start_http_proxy(int32_t s, char *ip, int32_t port, unsigned char option
    }

    if (debug) {
-      hydra_report(stderr,
-                   "S:%-.*s\n",
-                   (int)(strchr(http_proxy_buf, '\r') - http_proxy_buf),
-                   http_proxy_buf);
+      hydra_report(stderr, "S:%-.*s\n", (int)(strchr(http_proxy_buf, '\r') - http_proxy_buf), http_proxy_buf);
    }

-    while (http_proxy_buf != NULL &&
-           (auth_hdr = hydra_strcasestr(http_proxy_buf,
-                                        "Proxy-Authenticate:")) == NULL) {
+    while (http_proxy_buf != NULL && (auth_hdr = hydra_strcasestr(http_proxy_buf, "Proxy-Authenticate:")) == NULL) {
      free(http_proxy_buf);
      http_proxy_buf = hydra_receive_line(s);
    }
@@ -71,10 +66,7 @@ int32_t start_http_proxy(int32_t s, char *ip, int32_t port, unsigned char option
    }

    if (debug) {
-      hydra_report(stderr,
-                   "S:%-.*s\n",
-                   (int)(strchr(auth_hdr, '\r') - auth_hdr),
-                   auth_hdr);
+      hydra_report(stderr, "S:%-.*s\n", (int)(strchr(auth_hdr, '\r') - auth_hdr), auth_hdr);
    }

    // after the first query we should have been disconnected from web server
@@ -115,10 +107,7 @@ int32_t start_http_proxy(int32_t s, char *ip, int32_t port, unsigned char option
    }

    if (debug) {
-      hydra_report(stderr,
-                   "S:%-.*s\n",
-                   (int)(strchr(http_proxy_buf, '\r') - http_proxy_buf),
-                   http_proxy_buf);
+      hydra_report(stderr, "S:%-.*s\n", (int)(strchr(http_proxy_buf, '\r') - http_proxy_buf), http_proxy_buf);
    }
  } else {
    if (http_proxy_auth_mechanism == AUTH_NTLM || hydra_strcasestr(auth_hdr, "Proxy-Authenticate: NTLM") != NULL) {
@@ -196,7 +185,7 @@ int32_t start_http_proxy(int32_t s, char *ip, int32_t port, unsigned char option
        char *pbuffer, *result;

        http_proxy_auth_mechanism = AUTH_DIGESTMD5;
-        auth_hdr == NULL;
+        auth_hdr = NULL;
        pbuffer = hydra_strcasestr(http_proxy_buf, "Proxy-Authenticate: Digest ");
        strncpy(buffer, pbuffer + strlen("Proxy-Authenticate: Digest "), sizeof(buffer));
        buffer[sizeof(buffer) - 1] = '\0';
@@ -220,10 +209,7 @@ int32_t start_http_proxy(int32_t s, char *ip, int32_t port, unsigned char option
        }

        if (debug && http_proxy_buf != NULL) {
-          hydra_report(stderr,
-                       "S:%-.*s\n",
-                       (int)(strchr(http_proxy_buf, '\r') - http_proxy_buf),
-                       http_proxy_buf);
+          hydra_report(stderr, "S:%-.*s\n", (int)(strchr(http_proxy_buf, '\r') - http_proxy_buf), http_proxy_buf);
        }

        if (http_proxy_buf == NULL)
@@ -234,10 +220,7 @@ int32_t start_http_proxy(int32_t s, char *ip, int32_t port, unsigned char option
      {
        if (auth_hdr != NULL) {
          //          buf[strlen(http_proxy_buf) - 1] = '\0';
-          hydra_report(stderr,
-                       "Unsupported Auth type:\n%-.*s\n",
-                       (int)(strchr(http_proxy_buf, '\r') - auth_hdr),
-                       auth_hdr);
+          hydra_report(stderr, "Unsupported Auth type:\n%-.*s\n", (int)(strchr(http_proxy_buf, '\r') - auth_hdr), auth_hdr);
          auth_hdr = NULL;
          free(http_proxy_buf);
          http_proxy_buf = NULL;
@@ -249,19 +232,15 @@ int32_t start_http_proxy(int32_t s, char *ip, int32_t port, unsigned char option
    }
  }

-  ptr = ((char *)index(http_proxy_buf, ' ')) + 1;
-  if (*ptr == '2' ||
-      (*ptr == '3' && *(ptr + 2) == '1') ||
-      (*ptr == '3' && *(ptr + 2) == '2') ||
-      (*ptr == '4' && *(ptr + 2) == '4')
-    ) {
+  ptr = ((char *)strchr(http_proxy_buf, ' ')) + 1;
+  if (*ptr == '2' || (*ptr == '3' && *(ptr + 2) == '1') || (*ptr == '3' && *(ptr + 2) == '2') || (*ptr == '4' && *(ptr + 2) == '4')) {
    hydra_report_found_host(port, ip, "http-proxy", fp);
    hydra_completed_pair_found();
    free(http_proxy_buf);
    http_proxy_buf = NULL;
  } else {
    if (*ptr != '4')
-      hydra_report(stderr, "[INFO] Unusual return code: %c for %s:%s\n", (char)*(index(http_proxy_buf, ' ') + 1), login, pass);
+      hydra_report(stderr, "[INFO] Unusual return code: %c for %s:%s\n", (char)*(strchr(http_proxy_buf, ' ') + 1), login, pass);
    else if (verbose && *(ptr + 2) == '3')
      hydra_report(stderr, "[INFO] Potential success, could be false positive: %s:%s\n", login, pass);
    hydra_completed_pair();
@@ -10,7 +10,7 @@ char *http_buf = NULL;
 static char end_condition[END_CONDITION_MAX_LEN];
 int end_condition_type = -1;

-int32_t webport, freemischttp = 0;
+int32_t webport;
 int32_t http_auth_mechanism = AUTH_UNASSIGNED;

 int32_t start_http(int32_t s, char *ip, int32_t port, unsigned char options, char *miscptr, FILE *fp, char *type, ptr_header_node ptr_head) {
@@ -208,7 +208,7 @@ int32_t start_http(int32_t s, char *ip, int32_t port, unsigned char options, cha
  complete_line = 0;
  tmpreplybuf[0] = 0;

-  while (http_buf != NULL && (strstr(http_buf, "HTTP/1.") == NULL || (index(http_buf, '\n') == NULL && complete_line == 0))) {
+  while (http_buf != NULL && (strstr(http_buf, "HTTP/1.") == NULL || (strchr(http_buf, '\n') == NULL && complete_line == 0))) {
    if (debug)
      printf("il: %d, tmpreplybuf: %s, http_buf: %s\n", complete_line, tmpreplybuf, http_buf);
    if (tmpreplybuf[0] == 0 && strstr(http_buf, "HTTP/1.") != NULL) {
@@ -245,7 +245,7 @@ int32_t start_http(int32_t s, char *ip, int32_t port, unsigned char options, cha
  if (debug)
    hydra_report(stderr, "S:%s\n", http_buf);

-  ptr = ((char *)index(http_buf, ' '));
+  ptr = ((char *)strchr(http_buf, ' '));
  if (ptr != NULL)
    ptr++;
  if (ptr != NULL && (*ptr == '2' || *ptr == '3' || strncmp(ptr, "403", 3) == 0 || strncmp(ptr, "404", 3) == 0)) {
@@ -313,32 +313,16 @@ void service_http(char *ip, int32_t sp, unsigned char options, char *miscptr, FI
  int32_t myport = PORT_HTTP, mysslport = PORT_HTTP_SSL;
  char *ptr, *ptr2;
  ptr_header_node ptr_head = NULL;
+#ifdef AF_INET6
+  unsigned char addr6[sizeof(struct in6_addr)];
+#endif

  hydra_register_socket(sp);
  if (memcmp(hydra_get_next_pair(), &HYDRA_EXIT, sizeof(HYDRA_EXIT)) == 0)
    return;

-  if ((webtarget = strstr(miscptr, "://")) != NULL) {
-    webtarget += strlen("://");
-    if ((ptr2 = index(webtarget, ':')) != NULL) { /* step over port if present */
-      *ptr2 = 0;
-      ptr2++;
-      ptr = ptr2;
-      if (*ptr == '/' || (ptr = index(ptr2, '/')) != NULL)
-        miscptr = ptr;
-      else
-        miscptr = slash; /* to make things easier to user */
-    } else if ((ptr2 = index(webtarget, '/')) != NULL) {
-      miscptr = malloc(strlen(ptr2) + 1);
-      freemischttp = 1;
-      strcpy(miscptr, ptr2);
-      *ptr2 = 0;
-    } else
-      webtarget = hostname;
-  } else if (strlen(miscptr) == 0)
+  if (strlen(miscptr) == 0)
    miscptr = strdup("/");
-  if (webtarget == NULL)
-    webtarget = hostname;
  if (port != 0)
    webport = port;
  else if ((options & OPTION_SSL) == 0)
@@ -346,6 +330,27 @@ void service_http(char *ip, int32_t sp, unsigned char options, char *miscptr, FI
  else
    webport = mysslport;

+  /* normalise the webtarget for ipv6/port number */
+  webtarget = malloc(strlen(hostname) + 1 /* null */ + 6 /* :65535  */
+#ifdef AF_INET6
+                     + 2 /* [] */
+#endif
+  );
+#ifdef AF_INET6
+  /* let libc decide if target is an ipv6 address */
+  if (inet_pton(AF_INET6, hostname, addr6)) {
+    ptr = webtarget + sprintf(webtarget, "[%s]", hostname);
+  } else {
+#endif
+    ptr = webtarget + sprintf(webtarget, "%s", hostname);
+#ifdef AF_INET6
+  }
+#endif
+  if (options & OPTION_SSL && webport != PORT_HTTP_SSL || !(options & OPTION_SSL) && webport != PORT_HTTP) {
+    sprintf(ptr, ":%d", webport);
+  }
+  ptr = NULL;
+
  /* Advance to options string */
  ptr = miscptr;
  while (*ptr != 0 && (*ptr != ':' || *(ptr - 1) == '\\'))
@@ -380,8 +385,6 @@ void service_http(char *ip, int32_t sp, unsigned char options, char *miscptr, FI
        port = mysslport;
      }
      if (sock < 0) {
-        if (freemischttp)
-          free(miscptr);
        if (quiet != 1)
          fprintf(stderr, "[ERROR] Child with pid %d terminating, can not connect\n", (int32_t)getpid());
        hydra_child_exit(1);
@@ -395,13 +398,9 @@ void service_http(char *ip, int32_t sp, unsigned char options, char *miscptr, FI
    case 3: /* clean exit */
      if (sock >= 0)
        sock = hydra_disconnect(sock);
-      if (freemischttp)
-        free(miscptr);
      hydra_child_exit(0);
      return;
    default:
-      if (freemischttp)
-        free(miscptr);
      fprintf(stderr, "[ERROR] Caught unknown return code, exiting!\n");
      hydra_child_exit(0);
    }
@@ -295,13 +295,13 @@ int32_t internal__hydra_connect(char *host, int32_t port, int32_t type, int32_t

        send(s, buf, strlen(buf), 0);
        if (debug) {
-          char *ptr = index(buf, '\r');
+          char *ptr = strchr(buf, '\r');
          if (ptr != NULL)
            *ptr = 0;
          printf("DEBUG_CONNECT_PROXY_SENT: %s\n", buf);
        }
        recv(s, buf, 4096, 0);
-        if (strncmp("HTTP/", buf, 5) == 0 && (tmpptr = index(buf, ' ')) != NULL && *++tmpptr == '2') {
+        if (strncmp("HTTP/", buf, 5) == 0 && (tmpptr = strchr(buf, ' ')) != NULL && *++tmpptr == '2') {
          if (debug)
            printf("DEBUG_CONNECT_PROXY_OK\n");
        } else {
@@ -637,9 +637,11 @@ void hydra_child_exit(int32_t code) {
    __fck = write(intern_socket, "C", 1);
  else if (code == 2) /* application protocol error or service shutdown */
    __fck = write(intern_socket, "E", 1);
-  // code 3 means exit without telling mommy about it - a bad idea. mommy should
+  else if (code == 3) /* application protocol error or service shutdown */
+    __fck = write(intern_socket, "D", 1);
+  // code 4 means exit without telling mommy about it - a bad idea. mommy should
  // know
-  else if (code == -1 || code > 3) {
+  else if (code == -1 || code > 4) {
    fprintf(stderr, "[TOTAL FUCKUP] a module should not use "
                    "hydra_child_exit(-1) ! Fix it in the source please ...\n");
    __fck = write(intern_socket, "E", 1);
@@ -67,7 +67,16 @@ char proxy_string_type[MAX_PROXY_COUNT][10];
 char *proxy_authentication[MAX_PROXY_COUNT];
 char *cmdlinetarget;

+#ifndef __APPLE__
 typedef int32_t BOOL;
+#else /* __APPLE__ */
+/* ensure compatibility with objc libraries */
+#if (TARGET_OS_IPHONE && __LP64__) || TARGET_OS_WATCH
+typedef bool BOOL;
+#else
+typedef signed char BOOL;
+#endif
+#endif /* __APPLE__ */

 #define hydra_report fprintf

@@ -18,8 +18,8 @@ void dummy_oracle() { printf("\n"); }
 #else

 #include <oci.h>
-#include <sys/types.h>
 #include <stdbool.h>
+#include <sys/types.h>

 extern char *HYDRA_EXIT;

@@ -22,7 +22,10 @@ BOOL rdp_connect(char *server, int32_t port, char *domain, char *login, char *pa
  instance->settings->Username = login;
  instance->settings->Password = password;
  instance->settings->IgnoreCertificate = TRUE;
-  instance->settings->AuthenticationOnly = TRUE;
+  if (password[0] == 0)
+    instance->settings->AuthenticationOnly = FALSE;
+  else
+    instance->settings->AuthenticationOnly = TRUE;
  instance->settings->ServerHostname = server;
  instance->settings->ServerPort = port;
  instance->settings->Domain = domain;
@@ -54,6 +57,7 @@ int32_t start_rdp(char *ip, int32_t port, unsigned char options, char *miscptr,
  }

  login_result = rdp_connect(server, port, domain, login, pass);
+  if (debug) hydra_report(stderr, "[DEBUG] rdp reported %08x\n", login_result);
  switch (login_result) {
  case 0:
    // login success
@@ -42,7 +42,7 @@ int32_t get_sip_code(char *buf) {
  int32_t code;
  char tmpbuf[SIP_MAX_BUF], word[SIP_MAX_BUF];

-  if (sscanf(buf, "%s %i %s", tmpbuf, &code, word) != 3)
+  if (sscanf(buf, "%256s %i %256s", tmpbuf, &code, word) != 3)
    return -1;
  return code;
 }
@@ -71,14 +71,12 @@ int32_t start_sip(int32_t s, char *ip, char *lip, int32_t port, int32_t lport, u
  }

  int32_t has_sip_cred = 0;
-  int32_t try
-    = 0;
+  int32_t try = 0;

  /* We have to check many times because server may begin to send "100 Trying"
   * before "401 Unauthorized" */
  while (try < 2 && !has_sip_cred) {
-    try
-      ++;
+    try++;
    if (hydra_data_ready_timed(s, 3, 0) > 0) {
      i = hydra_recv(s, (char *)buf, sizeof(buf) - 1);
      if (i > 0)
@@ -160,14 +158,12 @@ int32_t start_sip(int32_t s, char *ip, char *lip, int32_t port, int32_t lport, u
  if (hydra_send(s, buffer, strlen(buffer), 0) < 0) {
    return 3;
  }
-  try
-    = 0;
+  try = 0;
  int32_t has_resp = 0;
  int32_t sip_code = 0;

  while (try < 2 && !has_resp) {
-    try
-      ++;
+    try++;
    if (hydra_data_ready_timed(s, 5, 0) > 0) {
      memset(buf, 0, sizeof(buf));
      if ((i = hydra_recv(s, (char *)buf, sizeof(buf) - 1)) >= 0)
@@ -1494,7 +1494,7 @@ int32_t service_smb_init(char *ip, int32_t sp, unsigned char options, char *misc
  ctime = time(NULL);
  do {
    usleepn(300);
-  } while ((ready = hydra_data_ready(sock)) <= 0 && ctime + 5 <= time(NULL));
+  } while ((ready = hydra_data_ready(sock)) <= 0 && ctime + 5 >= time(NULL));

  if (ready <= 0) {
    fprintf(stderr, "[ERROR] no reply from target smb://%s:%d/\n", hostname, port);
@@ -13,7 +13,7 @@
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 *
- * Copyright (C) 2020 Karim Kanso, all rights reserved.
+ * Copyright (C) 2021 Karim Kanso, all rights reserved.
 *  kaz 'dot' kanso 'at' g mail 'dot' com
 */

@@ -126,8 +126,13 @@ bool smb2_run_test(creds_t *cr, const char *server, uint16_t port) {

  */
  switch (errno) {
+  case ENOENT:
+    // Noticed this when connecting to older samba servers on linux
+    // where any credentials are accepted.
+    hydra_report(stderr, "[WARNING] %s might accept any credential\n", server);
  case EINVAL: // 22
-    // probably password ok
+    // probably password ok, nominal case when connecting to a windows
+    // smb server with good credentials.
    smbc_free_context(ctx, 1);
    return true;
    break;
@@ -147,6 +152,7 @@ bool smb2_run_test(creds_t *cr, const char *server, uint16_t port) {
  case ECONNREFUSED:
    // there are probably more codes that could be added here to
    // indicate connection errors.
+    hydra_report(stderr, "[ERROR] Error %s (%d) while connecting to %s\n", strerror(errno), errno, server);
    smbc_free_context(ctx, 1);
    EXIT_CONNECTION_ERROR;
    break;
@@ -202,6 +208,11 @@ int32_t service_smb2_init(char *ip, int32_t sp, unsigned char options, char *mis
      continue;
    }
    if (CMP(tkn_workgroup, miscptr)) {
+      if (workgroup != default_workgroup) {
+        // miscptr has already been processed, goto end
+        miscptr += strlen(miscptr) + 1;
+        continue;
+      }
      miscptr += sizeof(tkn_workgroup) - 1;
      char *p = strchr(miscptr, '}');
      if (p == NULL) {
@@ -217,6 +228,11 @@ int32_t service_smb2_init(char *ip, int32_t sp, unsigned char options, char *mis
      continue;
    }
    if (CMP(tkn_netbios, miscptr)) {
+      if (netbios_name != NULL) {
+        // miscptr has already been processed, goto end
+        miscptr += strlen(miscptr) + 1;
+        continue;
+      }
      miscptr += sizeof(tkn_netbios) - 1;
      char *p = strchr(miscptr, '}');
      if (p == NULL) {
@@ -128,13 +128,13 @@ int32_t start_smtp_enum(int32_t s, char *ip, int32_t port, unsigned char options
    //#endif
    //      hydra_report(stderr, "Server %s", err);
    //    }
-    if (strncmp(buf, "500 ", 4) == 0) {
+    if (strncmp(buf, "500 ", 4) == 0 || strncmp(buf, "502 ", 4) == 0) {
      hydra_report(stderr,
                   "[ERROR] command is disabled on the server (choose "
                   "different method): %s",
                   buf);
      free(buf);
-      return 3;
+      return 4;
    }
    memset(buffer, 0, sizeof(buffer));
    // 503 5.5.1 Error: nested MAIL command
@@ -245,6 +245,12 @@ void service_smtp_enum(char *ip, int32_t sp, unsigned char options, char *miscpt
      }
      hydra_child_exit(0);
      return;
+    case 4: /* unsupported exit */
+      if (sock >= 0) {
+        sock = hydra_disconnect(sock);
+      }
+      hydra_child_exit(3);
+      return;
    default:
      hydra_report(stderr, "[ERROR] Caught unknown return code, exiting!\n");
      hydra_child_exit(0);
@@ -34,11 +34,12 @@ int32_t start_ssh(int32_t s, char *ip, int32_t port, unsigned char options, char
  if (new_session) {
    if (session) {
      ssh_disconnect(session);
-      ssh_finalize();
+      // ssh_finalize();
      ssh_free(session);
+    } else {
+      ssh_init();
    }

-    ssh_init();
    session = ssh_new();
    ssh_options_set(session, SSH_OPTIONS_PORT, &port);
    ssh_options_set(session, SSH_OPTIONS_HOST, hydra_address2string(ip));
@@ -173,6 +174,7 @@ int32_t service_ssh_init(char *ip, int32_t sp, unsigned char options, char *misc
  //   3 skip target because its unreachable
 #ifdef LIBSSH
  int32_t rc, method;
+  ssh_init();
  ssh_session session = ssh_new();

  if (verbose || debug)
@@ -33,8 +33,9 @@ int32_t start_sshkey(int32_t s, char *ip, int32_t port, unsigned char options, c
  if (new_session) {
    if (session) {
      ssh_disconnect(session);
-      ssh_finalize();
      ssh_free(session);
+    } else {
+      ssh_init();
    }

    session = ssh_new();
@@ -36,7 +36,7 @@ int32_t start_telnet(int32_t s, char *ip, int32_t port, unsigned char options, c
    if ((buf = hydra_receive_line(s)) == NULL)
      return 1;

-    if (index(buf, '/') != NULL || index(buf, '>') != NULL || index(buf, '%') != NULL || index(buf, '$') != NULL || index(buf, '#') != NULL) {
+    if (strchr(buf, '/') != NULL || strchr(buf, '>') != NULL || strchr(buf, '%') != NULL || strchr(buf, '$') != NULL || strchr(buf, '#') != NULL) {
      hydra_report_found_host(port, ip, "telnet", fp);
      hydra_completed_pair_found();
      free(buf);
@@ -75,16 +75,41 @@ int32_t start_telnet(int32_t s, char *ip, int32_t port, unsigned char options, c
  }

  /*win7 answering with do terminal type = 0xfd 0x18 */
-  while ((buf = hydra_receive_line(s)) != NULL && make_to_lower(buf) && (strstr(buf, "login:") == NULL || strstr(buf, "last login:") != NULL) && strstr(buf, "sername:") == NULL) {
-    if ((miscptr != NULL && strstr(buf, miscptr) != NULL) || (miscptr == NULL && strstr(buf, "invalid") == NULL && strstr(buf, "failed") == NULL && strstr(buf, "bad ") == NULL && (index(buf, '/') != NULL || index(buf, '>') != NULL || index(buf, '$') != NULL || index(buf, '#') != NULL || index(buf, '%') != NULL || ((buf[1] == '\xfd') && (buf[2] == '\x18'))))) {
+  while ((buf = hydra_receive_line(s)) != NULL && make_to_lower(buf) && (strstr(buf, "password:") == NULL || strstr(buf, "login:") == NULL || strstr(buf, "last login:") != NULL) && strstr(buf, "sername:") == NULL) {
+    if ((miscptr != NULL && strstr(buf, miscptr) != NULL) || (miscptr == NULL && strstr(buf, "invalid") == NULL && strstr(buf, "incorrect") == NULL && strstr(buf, "bad ") == NULL && (strchr(buf, '/') != NULL || strchr(buf, '>') != NULL || strchr(buf, '$') != NULL || strchr(buf, '#') != NULL || strchr(buf, '%') != NULL || ((buf[1] == '\xfd') && (buf[2] == '\x18'))))) {
      hydra_report_found_host(port, ip, "telnet", fp);
      hydra_completed_pair_found();
      free(buf);
      if (memcmp(hydra_get_next_pair(), &HYDRA_EXIT, sizeof(HYDRA_EXIT)) == 0)
        return 3;
      return 1;
-    }
-    free(buf);
+    } else if (buf && strstr(buf, "assword:")) {
+      hydra_completed_pair();
+      // printf("password prompt\n");
+      free(buf);
+      if (strlen(pass = hydra_get_next_password()) == 0)
+        pass = empty;
+      sprintf(buffer, "%s\r", pass);
+      if (no_line_mode) {
+        for (i = 0; i < strlen(buffer); i++) {
+          if (strcmp(&buffer[i], "\r") == 0) {
+            send(s, "\r\0", 2, 0);
+          } else {
+            send(s, &buffer[i], 1, 0);
+          }
+          usleepn(20);
+        }
+      } else {
+        if (hydra_send(s, buffer, strlen(buffer) + 1, 0) < 0) {
+          return 1;
+        }
+      }
+    } else if (buf && strstr(buf, "login:")) {
+      free(buf);
+      hydra_completed_pair();
+      return 2;
+    } else
+      free(buf);
  }

  hydra_completed_pair();
@@ -19,7 +19,7 @@ int32_t vnc_client_version = RFB33;
 int32_t failed_auth = 0;

 extern char *HYDRA_EXIT;
-char *buf;
+static char *buf;

 /*
 * Encrypt CHALLENGESIZE bytes in memory using a password.
@@ -1,4 +1,4 @@
-.TH "HYDRA" "1" "01/01/2020"
+.TH "HYDRA" "1" "01/01/2021"
 .SH NAME
 hydra \- a very fast network logon cracker which supports many different services
 .SH SYNOPSIS
@@ -1,5 +1,5 @@
 /*
- * hydra (c) 2001-2020 by van Hauser / THC <vh@thc.org>
+ * hydra (c) 2001-2021 by van Hauser / THC <vh@thc.org>
 * https://github.com/vanhauser-thc/thc-hydra
 *
 * Parallized network login hacker.
@@ -11,6 +11,7 @@
 */
 #include "hydra.h"
 #include "bfg.h"
+#include <strings.h>

 #ifdef LIBNCURSES
 #include <curses.h>
@@ -77,6 +78,7 @@ extern void service_http_post_form(char *ip, int32_t sp, unsigned char options,
 extern void service_icq(char *ip, int32_t sp, unsigned char options, char *miscptr, FILE *fp, int32_t port, char *hostname);
 extern void service_pcnfs(char *ip, int32_t sp, unsigned char options, char *miscptr, FILE *fp, int32_t port, char *hostname);
 extern void service_mssql(char *ip, int32_t sp, unsigned char options, char *miscptr, FILE *fp, int32_t port, char *hostname);
+extern void service_cobaltstrike(char *ip, int32_t sp, unsigned char options, char *miscptr, FILE *fp, int32_t port, char *hostname);
 extern void service_cvs(char *ip, int32_t sp, unsigned char options, char *miscptr, FILE *fp, int32_t port, char *hostname);
 extern void service_snmp(char *ip, int32_t sp, unsigned char options, char *miscptr, FILE *fp, int32_t port, char *hostname);
 extern void service_smtp(char *ip, int32_t sp, unsigned char options, char *miscptr, FILE *fp, int32_t port, char *hostname);
@@ -177,6 +179,7 @@ extern int32_t service_imap_init(char *ip, int32_t sp, unsigned char options, ch
 extern int32_t service_irc_init(char *ip, int32_t sp, unsigned char options, char *miscptr, FILE *fp, int32_t port, char *hostname);
 extern int32_t service_ldap_init(char *ip, int32_t sp, unsigned char options, char *miscptr, FILE *fp, int32_t port, char *hostname);
 extern int32_t service_mssql_init(char *ip, int32_t sp, unsigned char options, char *miscptr, FILE *fp, int32_t port, char *hostname);
+extern int32_t service_cobaltstrike_init(char *ip, int32_t sp, unsigned char options, char *miscptr, FILE *fp, int32_t port, char *hostname);
 extern int32_t service_nntp_init(char *ip, int32_t sp, unsigned char options, char *miscptr, FILE *fp, int32_t port, char *hostname);
 extern int32_t service_pcanywhere_init(char *ip, int32_t sp, unsigned char options, char *miscptr, FILE *fp, int32_t port, char *hostname);
 extern int32_t service_pcnfs_init(char *ip, int32_t sp, unsigned char options, char *miscptr, FILE *fp, int32_t port, char *hostname);
@@ -201,7 +204,7 @@ extern int32_t service_rtsp_init(char *ip, int32_t sp, unsigned char options, ch
 extern int32_t service_rpcap_init(char *ip, int32_t sp, unsigned char options, char *miscptr, FILE *fp, int32_t port, char *hostname);

 // ADD NEW SERVICES HERE
-char *SERVICES = "adam6500 asterisk afp cisco cisco-enable cvs firebird ftp[s] "
+char *SERVICES = "adam6500 asterisk afp cisco cisco-enable cobaltstrike cvs firebird ftp[s] "
                 "http[s]-{head|get|post} http[s]-{get|post}-form http-proxy "
                 "http-proxy-urlenum icq imap[s] irc ldap2[s] ldap3[-{cram|digest}md5][s] "
                 "memcached mongodb mssql mysql ncp nntp oracle oracle-listener oracle-sid "
@@ -225,7 +228,7 @@ char *SERVICES = "adam6500 asterisk afp cisco cisco-enable cvs firebird ftp[s] "
 #define RESTOREFILE "./hydra.restore"

 #define PROGRAM "Hydra"
-#define VERSION "v9.1"
+#define VERSION "v9.3-dev"
 #define AUTHOR "van Hauser/THC"
 #define EMAIL "<vh@thc.org>"
 #define AUTHOR2 "David Maciejak"
@@ -401,6 +404,7 @@ static const struct {
                {"memcached", service_mcached_init, service_mcached, NULL},
 #endif
                SERVICE(mssql),
+                SERVICE(cobaltstrike),
 #ifdef LIBMONGODB
                SERVICE3("mongodb", mongodb),
 #endif
@@ -505,7 +509,7 @@ void help(int32_t ext) {
               "  -x MIN:MAX:CHARSET  password bruteforce generation, type "
               "\"-x -h\" to get help\n"
               "  -y        disable use of symbols in bruteforce, see above\n"
-               "  -r		 rainy mode for password generation (-x)\n"
+               "  -r        use a non-random shuffling method for option -x\n"
 #endif
               "  -e nsr    try \"n\" null password, \"s\" login as pass "
               "and/or \"r\" reversed login\n"
@@ -591,7 +595,7 @@ void help_bfg() {
         "             'A' for uppercase letters, '1' for numbers, and for all "
         "others,\n"
         "             just add their real representation.\n"
-         "  -y         disable the use of the above letters as placeholders\n\n"
+         "  -y         disable the use of the above letters as placeholders\n"
         "Examples:\n"
         "   -x 3:5:a  generate passwords from length 3 to 5 with all "
         "lowercase letters\n"
@@ -610,16 +614,12 @@ void help_bfg() {

 void module_usage() {
  int32_t i;
-  if (!hydra_options.service) {
-    printf("The Module %s does not need or support optional parameters\n", hydra_options.service);
-    exit(0);
-  }

  printf("\nHelp for module "
         "%s:\n================================================================"
         "============\n",
         hydra_options.service);
-  if (strncmp(hydra_options.service, "https-", 6) == 0 )
+  if (strncmp(hydra_options.service, "https-", 6) == 0)
    memmove(hydra_options.service + 4, hydra_options.service + 5, strlen(hydra_options.service) - 4);
  for (i = 0; i < sizeof(services) / sizeof(services[0]); i++) {
    if (strcmp(hydra_options.service, services[i].name) == 0) {
@@ -808,7 +808,7 @@ void hydra_restore_read() {
    fprintf(stderr,
            "[WARNING] restore file was created by version %c.%c, this is "
            "version %s\n",
-            buf[0], buf[2], VERSION);
+            buf[0], buf[1], VERSION);
  if (buf[2] != sizeof(int32_t) % 256 || buf[3] != sizeof(hydra_head *) % 256) {
    fprintf(stderr, "[ERROR] restore file was created on a different, "
                    "incompatible processor platform!\n");
@@ -884,11 +884,19 @@ void hydra_restore_read() {
    printf("[DEBUG] reading restore file: Step 8 complete\n");

  login_ptr = malloc(hydra_brains.sizelogin + hydra_brains.countlogin + 8);
+  if (!login_ptr) {
+    fprintf(stderr, "Error: malloc(%lu) failed\n", hydra_brains.sizelogin + hydra_brains.countlogin + 8);
+    exit(-1);
+  }
  fck = (int32_t)fread(login_ptr, hydra_brains.sizelogin + hydra_brains.countlogin + 8, 1, f);
  if (debug)
    printf("[DEBUG] reading restore file: Step 9 complete\n");
  if (!check_flag(hydra_options.mode, MODE_COLON_FILE)) { // NOT colonfile mode
    pass_ptr = malloc(hydra_brains.sizepass + hydra_brains.countpass + 8);
+    if (!pass_ptr) {
+      fprintf(stderr, "Error: malloc(%lu) failed\n", hydra_brains.sizepass + hydra_brains.countpass + 8);
+      exit(-1);
+    }
    fck = (int32_t)fread(pass_ptr, hydra_brains.sizepass + hydra_brains.countpass + 8, 1, f);
  } else {                                 // colonfile mode
    hydra_options.colonfile = empty_login; // dummy
@@ -898,8 +906,16 @@ void hydra_restore_read() {
    printf("[DEBUG] reading restore file: Step 10 complete\n");

  hydra_targets = (hydra_target **)malloc((hydra_brains.targets + 3) * sizeof(hydra_target *));
+  if (!hydra_targets) {
+    fprintf(stderr, "Error: malloc(%lu) failed\n", (hydra_brains.targets + 3) * sizeof(hydra_target *));
+    exit(-1);
+  }
  for (j = 0; j < hydra_brains.targets; j++) {
    hydra_targets[j] = malloc(sizeof(hydra_target));
+    if (!hydra_targets[j]) {
+      fprintf(stderr, "Error: malloc(%lu) failed\n", sizeof(hydra_target));
+      exit(-1);
+    }
    fck = (int32_t)fread(hydra_targets[j], sizeof(hydra_target), 1, f);
    sck = fgets(out, sizeof(out), f);
    if (out[0] != 0 && out[strlen(out) - 1] == '\n')
@@ -951,8 +967,16 @@ void hydra_restore_read() {
  if (debug)
    printf("[DEBUG] reading restore file: Step 11 complete\n");
  hydra_heads = malloc(sizeof(hydra_head *) * hydra_options.max_use);
+  if (!hydra_heads) {
+    fprintf(stderr, "Error: malloc(%lu) failed\n", sizeof(hydra_head *) * hydra_options.max_use);
+    exit(-1);
+  }
  for (j = 0; j < hydra_options.max_use; j++) {
    hydra_heads[j] = malloc(sizeof(hydra_head));
+    if (!hydra_heads[j]) {
+      fprintf(stderr, "Error: malloc(%lu) failed\n", sizeof(hydra_head));
+      exit(-1);
+    }
    fck = (int32_t)fread(hydra_heads[j], sizeof(hydra_head), 1, f);
    hydra_heads[j]->sp[0] = -1;
    hydra_heads[j]->sp[1] = -1;
@@ -1108,7 +1132,7 @@ void fill_mem(char *ptr, FILE *fd, int32_t colonmode) {
            tmp[len] = 0;
          }
          if (colonmode) {
-            if ((ptr2 = index(tmp, ':')) == NULL) {
+            if ((ptr2 = strchr(tmp, ':')) == NULL) {
              fprintf(stderr,
                      "[ERROR] invalid line in colon file (-C), missing colon "
                      "in line: %s\n",
@@ -1321,6 +1345,7 @@ int32_t hydra_lookup_port(char *service) {
                                      {"memcached", PORT_MCACHED, PORT_MCACHED_SSL},
                                      {"mongodb", PORT_MONGODB, PORT_MONGODB},
                                      {"mssql", PORT_MSSQL, PORT_MSSQL_SSL},
+                                      {"cobaltstrike", PORT_COBALTSTRIKE, PORT_COBALTSTRIKE_SSL},
                                      {"mysql", PORT_MYSQL, PORT_MYSQL_SSL},
                                      {"postgres", PORT_POSTGRES, PORT_POSTGRES_SSL},
                                      {"pcanywhere", PORT_PCANYWHERE, PORT_PCANYWHERE_SSL},
@@ -1471,7 +1496,7 @@ void hydra_increase_fail_count(int32_t target_no, int32_t head_no) {
          fprintf(stderr,
                  "[ERROR] Too many connect errors to target, disabling "
                  "%s://%s%s%s:%d\n",
-                  hydra_options.service, hydra_targets[target_no]->ip[0] == 16 && index(hydra_targets[target_no]->target, ':') != NULL ? "[" : "", hydra_targets[target_no]->target, hydra_targets[target_no]->ip[0] == 16 && index(hydra_targets[target_no]->target, ':') != NULL ? "]" : "", hydra_targets[target_no]->port);
+                  hydra_options.service, hydra_targets[target_no]->ip[0] == 16 && strchr(hydra_targets[target_no]->target, ':') != NULL ? "[" : "", hydra_targets[target_no]->target, hydra_targets[target_no]->ip[0] == 16 && strchr(hydra_targets[target_no]->target, ':') != NULL ? "]" : "", hydra_targets[target_no]->port);
        }
        if (hydra_brains.targets > hydra_brains.finished)
          hydra_kill_head(head_no, 1, 0);
@@ -1781,7 +1806,7 @@ int32_t hydra_send_next_pair(int32_t target_no, int32_t head_no) {
 #ifndef HAVE_MATH_H
                  sleep(1);
 #else
-                  hydra_targets[target_no]->pass_ptr = bf_next(hydra_options.rainy);
+                  hydra_targets[target_no]->pass_ptr = bf_next();
                  if (debug)
                    printf("[DEBUG] bfg new password for next child: %s\n", hydra_targets[target_no]->pass_ptr);
 #endif
@@ -1908,8 +1933,11 @@ int32_t hydra_send_next_pair(int32_t target_no, int32_t head_no) {
                // the above line
    }
    if (debug || hydra_options.showAttempt) {
-      printf("[%sATTEMPT] target %s - login \"%s\" - pass \"%s\" - %" hPRIu64 " of %" hPRIu64 " [child %d] (%d/%d)\n", hydra_targets[target_no]->redo_state ? "REDO-" : snp_is_redo ? "RE-" : "", hydra_targets[target_no]->target, hydra_heads[head_no]->current_login_ptr, hydra_heads[head_no]->current_pass_ptr, hydra_targets[target_no]->sent, hydra_brains.todo + hydra_targets[target_no]->redo, head_no, hydra_targets[target_no]->redo_state ? hydra_targets[target_no]->redo_state - 1 : 0,
-             hydra_targets[target_no]->redo);
+      printf("[%sATTEMPT] target %s - login \"%s\" - pass \"%s\" - %" hPRIu64 " of %" hPRIu64 " [child %d] (%d/%d)\n",
+             hydra_targets[target_no]->redo_state ? "REDO-"
+             : snp_is_redo                        ? "RE-"
+                                                  : "",
+             hydra_targets[target_no]->target, hydra_heads[head_no]->current_login_ptr, hydra_heads[head_no]->current_pass_ptr, hydra_targets[target_no]->sent, hydra_brains.todo + hydra_targets[target_no]->redo, head_no, hydra_targets[target_no]->redo_state ? hydra_targets[target_no]->redo_state - 1 : 0, hydra_targets[target_no]->redo);
    }
    loop_cnt = 0;
    return 0;
@@ -1934,7 +1962,7 @@ void hydra_skip_user(int32_t target_no, char *username) {
    hydra_targets[target_no]->skipcnt++;
  }
  if (hydra_options.loop_mode == 0 && !check_flag(hydra_options.mode, MODE_COLON_FILE)) {
-    if (memcmp(username, hydra_targets[target_no]->login_ptr, strlen(username)) == 0) {
+    if (strcmp(username, hydra_targets[target_no]->login_ptr) == 0) {
      if (debug)
        printf("[DEBUG] skipping username %s\n", username);
      // increase count
@@ -2024,11 +2052,11 @@ void process_proxy_line(int32_t type, char *string) {
  }
  *sep = 0;
  target_string = sep + 3;
-  if ((sep = index(target_string, '@')) != NULL) {
+  if ((sep = strchr(target_string, '@')) != NULL) {
    auth_string = target_string;
    *sep = 0;
    target_string = sep + 1;
-    if (index(auth_string, ':') == NULL) {
+    if (strchr(auth_string, ':') == NULL) {
      fprintf(stderr,
              "[WARNING] %s has an invalid authentication definition %s, must "
              "be in the format login:pass, entry ignored\n",
@@ -2036,14 +2064,14 @@ void process_proxy_line(int32_t type, char *string) {
      return;
    }
  }
-  if ((sep = index(target_string, ':')) != NULL) {
+  if ((sep = strchr(target_string, ':')) != NULL) {
    *sep = 0;
    port_string = sep + 1;
-    if ((sep = index(port_string, '%')) != NULL) {
+    if ((sep = strchr(port_string, '%')) != NULL) {
      *sep = 0;
      device_string = sep + 1;
    }
-    if ((sep = index(port_string, '/')) != NULL)
+    if ((sep = strchr(port_string, '/')) != NULL)
      *sep = 0;
    port = atoi(port_string);
    if (port < 1 || port > 65535) {
@@ -2153,7 +2181,7 @@ int main(int argc, char *argv[]) {
  struct sockaddr_in6 *ipv6 = NULL;
  struct sockaddr_in *ipv4 = NULL;

-  printf("%s %s (c) 2020 by %s & %s - Please do not use in military or secret "
+  printf("%s %s (c) 2021 by %s & %s - Please do not use in military or secret "
         "service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).\n\n",
         PROGRAM, VERSION, AUTHOR, AUTHOR2);
 #ifndef LIBAFP
@@ -2192,6 +2220,10 @@ int main(int argc, char *argv[]) {
  SERVICES = hydra_string_replace(SERVICES, "radmin2 ", "");
  strcat(unsupported, "radmin2 ");
 #endif
+#ifndef LIBFREERDP
+  SERVICES = hydra_string_replace(SERVICES, "rdp ", "");
+  strcat(unsupported, "rdp ");
+#endif
 #ifndef LIBSAPR3
  SERVICES = hydra_string_replace(SERVICES, "sapr3 ", "");
  strcat(unsupported, "sapr3 ");
@@ -2239,11 +2271,6 @@ int main(int argc, char *argv[]) {
  strcat(unsupported, "SSL-services (ftps, sip, rdp, oracle-services, ...) ");
 #endif

-#ifndef LIBFREERDP
-  // for rdp
-  SERVICES = hydra_string_replace(SERVICES, " rdp", "");
-#endif
-
 #ifndef HAVE_MATH_H
  if (strlen(unsupported) > 0)
    strcat(unsupported, "and ");
@@ -2281,7 +2308,6 @@ int main(int argc, char *argv[]) {
  hydra_brains.ofp = stdout;
  hydra_brains.targets = 1;
  hydra_options.waittime = waittime = WAITTIME;
-  hydra_options.rainy = 0;
  bf_options.disable_symbols = 0;

  // command line processing
@@ -2317,7 +2343,7 @@ int main(int argc, char *argv[]) {
      hydra_restore_read();
      break;
    case 'r':
-      hydra_options.rainy = 1;
+      fprintf(stderr, "Warning: the option -r has been removed.\n");
      break;
    case 'I':
      ignore_restore = 1; // this is not to be saved in hydra_options!
@@ -2573,23 +2599,23 @@ int main(int argc, char *argv[]) {

        if (*target_pos == '[') {
          target_pos++;
-          if ((param_pos = index(target_pos, ']')) == NULL)
+          if ((param_pos = strchr(target_pos, ']')) == NULL)
            bail("no closing ']' found in target definition");
          *param_pos++ = 0;
          if (*param_pos == ':')
            port_pos = ++param_pos;
-          if ((param_pos = index(param_pos, '/')) != NULL)
+          if ((param_pos = strchr(param_pos, '/')) != NULL)
            *param_pos++ = 0;
        } else {
-          port_pos = index(target_pos, ':');
-          param_pos = index(target_pos, '/');
+          port_pos = strchr(target_pos, ':');
+          param_pos = strchr(target_pos, '/');
          if (port_pos != NULL && param_pos != NULL && port_pos > param_pos)
            port_pos = NULL;
          if (port_pos != NULL)
            *port_pos++ = 0;
          if (param_pos != NULL)
            *param_pos++ = 0;
-          if (port_pos != NULL && index(port_pos, ':') != NULL) {
+          if (port_pos != NULL && strchr(port_pos, ':') != NULL) {
            if (prefer_ipv6)
              bail("Illegal IPv6 target definition must be written within '[' "
                   "']'");
@@ -2778,6 +2804,8 @@ int main(int argc, char *argv[]) {
    }
    if (strcmp(hydra_options.service, "mssql") == 0)
      i = 1;
+    if (strcmp(hydra_options.service, "cobaltstrike") == 0)
+      i = 2;
    if ((strcmp(hydra_options.service, "oracle-listener") == 0) || (strcmp(hydra_options.service, "tns") == 0)) {
      i = 2;
      hydra_options.service = malloc(strlen("oracle-listener") + 1);
@@ -2872,7 +2900,7 @@ int main(int argc, char *argv[]) {
                        "like parallel connections)\n");
        hydra_options.tasks = 1;
      }
-      if (hydra_options.login != NULL && (index(hydra_options.login, '\\') != NULL || index(hydra_options.login, '/') != NULL))
+      if (hydra_options.login != NULL && (strchr(hydra_options.login, '\\') != NULL || strchr(hydra_options.login, '/') != NULL))
        fprintf(stderr, "[WARNING] potential windows domain specification found in "
                        "login. You must use the -m option to pass a domain.\n");
      i = 1;
@@ -2896,7 +2924,7 @@ int main(int argc, char *argv[]) {
 #if !defined(LIBSMBCLIENT)
      bail("Compiled without LIBSMBCLIENT support, module not available!");
 #else
-      if (hydra_options.login != NULL && (index(hydra_options.login, '\\') != NULL || index(hydra_options.login, '/') != NULL))
+      if (hydra_options.login != NULL && (strchr(hydra_options.login, '\\') != NULL || strchr(hydra_options.login, '/') != NULL))
        fprintf(stderr, "[WARNING] potential windows domain specification found in "
                        "login. You must use the -m option to pass a domain.\n");
      if (hydra_options.miscptr == NULL || (strlen(hydra_options.miscptr) == 0)) {
@@ -3187,7 +3215,6 @@ int main(int argc, char *argv[]) {
        printf("[INFO] Using HTTP Proxy: %s\n", getenv("HYDRA_PROXY_HTTP"));
        use_proxy = 1;
      }
-
      if (strstr(hydra_options.miscptr, "\\:") != NULL) {
        fprintf(stderr, "[INFORMATION] escape sequence \\: detected in module "
                        "option, no parameter verification is performed.\n");
@@ -3216,6 +3243,7 @@ int main(int argc, char *argv[]) {
            fprintf(stderr, "[ERROR] Wrong syntax of optional argument: %s\n", optional1);
            exit(-1);
          }
+
          switch (optional1[0]) {
          case 'C': // fall through
          case 'c':
@@ -3288,6 +3316,9 @@ int main(int argc, char *argv[]) {
      hydra_options.port = port;
    }

+    if (hydra_options.login == NULL && hydra_options.loginfile == NULL)
+      hydra_options.exit_found = 1;
+
    if (hydra_options.ssl == 0 && hydra_options.port == 443)
      fprintf(stderr, "[WARNING] you specified port 443 for attacking a http "
                      "service, however did not specify the -S ssl switch nor "
@@ -3433,7 +3464,8 @@ int main(int argc, char *argv[]) {
 #ifdef HAVE_MATH_H
            if (bf_init(bf_options.arg))
              exit(-1); // error description is handled by bf_init
-            pass_ptr = bf_next(hydra_options.rainy);
+
+            pass_ptr = bf_next();
            hydra_brains.countpass += bf_get_pcount();
            hydra_brains.sizepass += BF_BUFLEN;
 #else
@@ -3548,13 +3580,13 @@ int main(int argc, char *argv[]) {
        if (*tmpptr == '[') {
          tmpptr++;
          hydra_targets[i]->target = tmpptr;
-          if ((tmpptr2 = index(tmpptr, ']')) != NULL) {
+          if ((tmpptr2 = strchr(tmpptr, ']')) != NULL) {
            *tmpptr2++ = 0;
            tmpptr = tmpptr2;
          }
        } else
          hydra_targets[i]->target = tmpptr;
-        if ((tmpptr2 = index(hydra_targets[i]->target, ':')) != NULL) {
+        if ((tmpptr2 = strchr(tmpptr, ':')) != NULL) {
          *tmpptr2++ = 0;
          tmpptr = tmpptr2;
          hydra_targets[i]->port = atoi(tmpptr2);
@@ -3570,13 +3602,13 @@ int main(int argc, char *argv[]) {
    } else if (hydra_options.server == NULL) {
      fprintf(stderr, "Error: no target server given, nor -M option used\n");
      exit(-1);
-    } else if (index(hydra_options.server, '/') != NULL) {
+    } else if (strchr(hydra_options.server, '/') != NULL) {
      if (cmdlinetarget == NULL)
        bail("You seem to mix up \"service://target:port/options\" syntax with "
             "\"target service options\" syntax. Read the README on how to use "
             "hydra correctly!");
      if (strstr(cmdlinetarget, "://") != NULL) {
-        tmpptr = index(hydra_options.server, '/');
+        tmpptr = strchr(hydra_options.server, '/');
        if (tmpptr != NULL)
          *tmpptr = 0;
        countservers = hydra_brains.targets = 1;
@@ -3599,7 +3631,7 @@ int main(int argc, char *argv[]) {
          exit(-1);
        }
        strcpy(tmpptr, hydra_options.server);
-        tmpptr2 = index(tmpptr, '/');
+        tmpptr2 = strchr(tmpptr, '/');
        *tmpptr2++ = 0;
        if ((k = atoi(tmpptr2)) < 16 || k > 31) {
          fprintf(stderr, "Error: network size may only be between /16 and /31: %s\n", hydra_options.server);
@@ -3765,7 +3797,7 @@ int main(int argc, char *argv[]) {
  printf(" per task\n");

  if (hydra_brains.targets == 1) {
-    if (index(hydra_targets[0]->target, ':') == NULL) {
+    if (strchr(hydra_targets[0]->target, ':') == NULL) {
      printf("[DATA] attacking %s%s://%s:", hydra_options.service, hydra_options.ssl == 1 ? "s" : "", hydra_targets[0]->target);
      printf("%d%s%s\n", port, hydra_options.miscptr == NULL || hydra_options.miscptr[0] != '/' ? "/" : "", hydra_options.miscptr != NULL ? hydra_options.miscptr : "");
    } else {
@@ -3841,7 +3873,7 @@ int main(int argc, char *argv[]) {
 #ifdef AF_INET6
    ipv6 = NULL;
 #endif
-    if ((device = index(hydra_targets[i]->target, '%')) != NULL)
+    if ((device = strchr(hydra_targets[i]->target, '%')) != NULL)
      *device++ = 0;
    if (getaddrinfo(hydra_targets[i]->target, NULL, &hints, &res) != 0) {
      if (use_proxy == 0) {
@@ -3907,9 +3939,10 @@ int main(int argc, char *argv[]) {
      }
      freeaddrinfo(res);
    }
-    // restore device information if present
+    // restore device information if present (overwrite null bytes)
    if (device != NULL) {
-      *(device - 1) = '%';
+      char *tmpptr = device - 1;
+      *tmpptr = '%';  // you can ignore the compiler warning
      fprintf(stderr, "[WARNING] not all modules support BINDTODEVICE for IPv6 "
                      "link local addresses, e.g. SSH does not\n");
    }
@@ -4130,6 +4163,21 @@ int main(int argc, char *argv[]) {
                fck = write(hydra_heads[head_no]->sp[1], "n", 1); // small hack
                break;

+              case 'D': // disable target, unknown protocol or feature
+                for (j = 0; j < hydra_brains.targets; j++)
+                  if (hydra_targets[j]->done == TARGET_ACTIVE) {
+                    hydra_targets[j]->done = TARGET_FINISHED;
+                    hydra_brains.finished++;
+                  }
+                for (j = 0; j < hydra_options.max_use; j++)
+                  if (hydra_heads[j]->active >= 0 && hydra_heads[j]->target_no == target_no) {
+                    if (hydra_brains.targets > hydra_brains.finished)
+                      hydra_kill_head(j, 1, 0); // kill all heads working on the target
+                    else
+                      hydra_kill_head(j, 1, 2); // kill all heads working on the target
+                  }
+                break;
+
              // we do not make a difference between 'C' and 'E' results - yet
              case 'E': // head reports protocol error
              case 'C': // head reports connect error
@@ -101,6 +101,8 @@
 #define PORT_MYSQL_SSL 3306
 #define PORT_MSSQL 1433
 #define PORT_MSSQL_SSL 1433
+#define PORT_COBALTSTRIKE 50050
+#define PORT_COBALTSTRIKE_SSL 50050
 #define PORT_POSTGRES 5432
 #define PORT_POSTGRES_SSL 5432
 #define PORT_ORACLE 1521
@@ -206,7 +208,6 @@ typedef struct {
  char *server;
  char *service;
  char bfg;
-  _Bool rainy;
  int32_t skip_redo;
 } hydra_option;

@@ -0,0 +1,10 @@
+[Desktop Entry]
+Name=XHydra
+GenericName=Hydra very fast network log-on cracker
+Comment=GUI frontend for Hydra network log-on cracker
+Version=1.0
+Exec=xhydra
+Icon=xhydra
+Terminal=false
+Type=Application
+Categories=System;Security;GTK;
Author	SHA1	Message	Date
van Hauser	022790867d	Merge pull request #691 from Schweinepriester/patch-1 README: HTTP => HTTPS	2021-11-07 13:33:26 +01:00
Kai	f20ca77309	README: HTTP => HTTPS	2021-11-05 17:47:21 +01:00
vanhauser-thc	9b055287c0	fix -M ipv6	2021-11-01 14:13:51 +01:00
vanhauser-thc	13db28f9d2	rdp empty pw fix	2021-10-27 17:19:13 +02:00
vanhauser-thc	3e364483d2	support xcode	2021-10-20 16:29:52 +02:00
vanhauser-thc	89fbd9a44d	debug	2021-10-14 10:14:42 +02:00
vanhauser-thc	b3bd068334	fix nits	2021-10-06 15:21:26 +02:00
vanhauser-thc	5cb14100f8	remove old option from help output	2021-08-31 09:37:06 +02:00
vanhauser-thc	67ef4c733f	code format	2021-08-23 11:31:58 +02:00
van Hauser	09453c7be8	Merge pull request #681 from ultimaiiii/master New CobaltStrike module	2021-08-23 11:28:32 +02:00
ultimaiiii	c9da867141	Move CS service to keep service list sorted	2021-08-21 17:12:40 +00:00
ultimaiiii	cb8fccda71	Rename MS to CS	2021-08-21 17:07:40 +00:00
ultimaiiii	63badb59af	Makefile fix	2021-08-20 23:18:46 +00:00
ultimaiiii	84c7b116db	New CobaltStrike module	2021-08-20 23:09:51 +00:00
vanhauser-thc	93cee75419	added make uninstall	2021-08-17 18:21:43 +02:00
van Hauser	403d00e897	Merge pull request #675 from horner/master telnet detects password retries with same user	2021-08-06 11:54:26 +02:00
horner	edc910628f	telnet detects password retries with same user	2021-08-05 13:52:18 -04:00
vanhauser-thc	cf20153655	smtp-enum: skip host on unsupported command	2021-08-01 11:06:15 +02:00
vanhauser-thc	b375bbc332	skip host when password is found on password-only checks	2021-06-29 12:15:03 +02:00
vanhauser-thc	0b1f3c5037	fix ssh for -M and ip/range	2021-06-29 12:04:36 +02:00
vanhauser-thc	93283091d0	sscanf change	2021-06-24 09:22:53 +02:00
vanhauser-thc	d3f784ab64	fix	2021-06-17 16:17:44 +02:00
vanhauser-thc	92ef7d7455	Revert "Merge pull request #666 from Yisus7u7/master" This reverts commit `5b98a23140`, reversing changes made to `a6784e4021`.	2021-06-17 16:16:43 +02:00
van Hauser	5b98a23140	Merge pull request #666 from Yisus7u7/master Add more files to GitHub pages	2021-06-17 16:13:18 +02:00
Yisus7u7	12dc488f3f	Set theme jekyll-theme-slate	2021-06-16 22:55:27 -05:00
Yisus7u7	486a6bddde	Merge branch 'vanhauser-thc:master' into master	2021-06-16 16:31:08 -05:00
Yisus7u7	e02b0d41e5	Show repo info in image	2021-06-16 16:30:45 -05:00
Yisus7u7	3b9280da3a	Update README.md	2021-06-16 16:19:51 -05:00
Yisus7u7	cf325b0008	Update README.md	2021-06-16 16:18:57 -05:00
Yisus7u7	9fc4aabd6b	Update index.md	2021-06-16 16:15:08 -05:00
Yisus7u7	54c2e85d79	Update index.md	2021-06-16 16:13:24 -05:00
Yisus7u7	d260804d19	Update index.md	2021-06-16 16:12:12 -05:00
Yisus7u7	2d12a0df6a	Create index.md	2021-06-16 16:06:21 -05:00
Yisus7u7	bfdbeee1b2	Delete index.md	2021-06-16 15:54:06 -05:00
Yisus7u7	caf39e1542	Update README.md	2021-06-16 15:51:52 -05:00
Yisus7u7	be95247c69	Update README.md	2021-06-16 15:48:43 -05:00
Yisus7u7	0483351e6a	Create index.md	2021-06-16 15:44:42 -05:00
van Hauser	a6784e4021	Merge pull request #665 from Yisus7u7/master Add GitHub pages service	2021-06-16 21:56:20 +02:00
Yisus7u7	27cab133fa	Delete index.md	2021-06-16 12:56:27 -05:00
Yisus7u7	24395ab478	Set theme jekyll-theme-midnight	2021-06-16 12:53:17 -05:00
Yisus7u7	55682bf69a	Set theme jekyll-theme-modernist	2021-06-16 12:51:29 -05:00
Yisus7u7	7601493400	Create index.md	2021-06-16 12:50:01 -05:00
Yisus7u7	3450d87420	Update _config.yml	2021-06-16 12:46:23 -05:00
Yisus7u7	acd4bcf1a7	Set theme jekyll-theme-hacker	2021-06-16 12:43:58 -05:00
vanhauser-thc	bc9190d3dd	fix	2021-06-16 11:18:12 +02:00
van Hauser	659ab10b14	Merge pull request #664 from Yisus7u7/master Add termux setup file (android)	2021-06-16 11:16:07 +02:00
Yisus7u7	f1cc9e6cfb	Specify in the INSTALL file the steps for Android (termux)	2021-06-16 03:06:40 -05:00
Yisus7u7	b7e77d7672	Specify in the INSTALL file the steps for Android (termux)	2021-06-16 03:03:31 -05:00
Yisus7u7	f12dc459c1	Specify in the INSTALL file the steps for Android (termux)	2021-06-16 03:01:07 -05:00
Yisus7u7	ef3c334671	Add termux setup file (android)	2021-06-16 02:30:45 -05:00
van Hauser	4de7595357	Merge pull request #662 from abhackerofficial/patch-1 Fixed data types.	2021-06-12 11:40:48 +02:00
ABHacker Official	19432a2173	Fixed data types.	2021-06-12 11:34:57 +05:30
van Hauser	fb0b2e030e	Merge pull request #651 from wj0s3ph/master fix: skip user bug	2021-05-19 14:28:20 +02:00
wj0seph	221876598b	fix: skip user bug username can potentially be identical to the beginning of login_ptr	2021-05-19 20:18:49 +08:00
van Hauser	fc70daa757	Merge pull request #648 from sanmacorz/master Changed index() to strchr()	2021-05-16 18:13:38 +02:00
sanmacorz	c81f0b97e7	Changed index() to strchr()	2021-05-12 12:22:48 -05:00
van Hauser	d6a42ace44	Merge pull request #638 from chris-pcguy/master Fix logic bug	2021-04-26 21:10:33 +02:00
Christian Inci	a2d715b870	Fix logic bug I can provide another patch version, which swaps the operands instead. Signed-off-by: Christian Inci <chris.gh@broke-the-inter.net>	2021-04-26 20:56:22 +02:00
vanhauser-thc	dd8348bcf0	removed bad entries in dpl	2021-04-23 17:06:18 +02:00
vanhauser-thc	bd2f949b34	removed bad entries in dpl	2021-04-23 17:05:58 +02:00
vanhauser-thc	e7b3d09d00	removed bad entries in dpl	2021-04-23 16:07:50 +02:00
vanhauser-thc	593c5b151a	fix macos + freerdp	2021-04-16 09:50:14 +02:00
vanhauser-thc	0749b9be9f	malloc checks for restore	2021-04-15 11:35:34 +02:00
van Hauser	6381ab2cd3	Merge pull request #623 from xambroz/desktop-launcher Desktop launcher	2021-03-24 08:51:26 +01:00
xambroz	5c9184061f	Install the desktop launcher for xhydra	2021-03-24 04:20:43 +01:00
xambroz	f250c8a191	Add the desktop launcher file	2021-03-24 03:52:36 +01:00
xambroz	b6dda7da81	Add transparent PNG file to be used as icon Add transparent PNG file to be used as launcher icon. The original JPG is not transparent so it doesn't go well with window theme.	2021-03-24 03:50:55 +01:00
van Hauser	fd55766ea3	Merge pull request #621 from mexicarne/master Fix assignment	2021-03-17 11:11:21 +01:00
Ruslan Makhmatkhanov	2ec0b164ca	fix typo: comparison -> assignment	2021-03-17 13:04:24 +03:00
Ruslan Makhmatkhanov	2cbbc53692	Merge pull request #1 from vanhauser-thc/master merge upstream	2021-03-17 13:02:07 +03:00
vanhauser-thc	fe930f4dd1	hydra 9.2 release	2021-03-15 18:52:54 +01:00
vanhauser-thc	cedbd0ddb2	indent	2021-03-11 14:00:40 +01:00
vanhauser-thc	f423875d90	remove rain mode	2021-03-11 14:00:00 +01:00
vanhauser-thc	ac2fd35b4f	allow configure to pick up PKG_CONFIG	2021-02-19 09:19:05 +01:00
van Hauser	51da37bfd8	Update issue templates	2021-01-29 10:29:28 +01:00
van Hauser	0407699583	Update issue templates	2021-01-29 10:23:27 +01:00
van Hauser	09f6a71e84	2021	2021-01-01 12:20:49 +01:00
van Hauser	6364bf329b	Merge pull request #586 from kazkansouh/http-get-ipv6 http-get: ipv6 fix	2020-12-27 00:32:06 +01:00
Karim Kanso	37a0eeaabe	www: normalise webtarget	2020-12-26 16:42:57 +00:00
van Hauser	08fc0fb2e2	Merge pull request #582 from e2002e/master cleanup	2020-12-04 17:09:00 +01:00
y	3be6824fa2	cleanup	2020-12-04 12:50:46 +01:00
van Hauser	53290bb5cc	Merge pull request #569 from e2002e/master Rain mode	2020-11-30 13:56:15 +01:00
van Hauser	469cafb639	Merge pull request #579 from kazkansouh/http-form-ipv6 http-form: ipv6 fix	2020-11-30 13:54:38 +01:00
e2002e	026ea7017e	Merge branch 'master' into master	2020-11-14 13:22:53 +00:00
owein	1a1bcf3855	uptodate with rainycrack	2020-11-14 14:20:00 +01:00
van Hauser	ea50c0a11f	Merge pull request #578 from kazkansouh/libsmbclient-miscptr smb2: fix parsing of miscptr	2020-11-13 15:08:32 +01:00
owein	78b3358862	profound mangling	2020-11-12 17:06:53 +01:00
Karim Kanso	7f19248e34	resolve compiler warnings identified by gcc 9.3.0	2020-11-12 15:31:03 +00:00
Karim Kanso	981e19852b	www-form: normalise webtarget	2020-11-12 15:31:03 +00:00
Karim Kanso	1df1d63c4f	smb2: fix parsing of miscptr	2020-11-11 11:18:04 +00:00
owein	56d1726edf	lqst commit	2020-11-09 19:41:00 +01:00
owein	b61dbacca9	up to last fix	2020-11-09 19:25:26 +01:00
owein	5e98fe23e7	see https://github.com/e2002e/zhou	2020-10-22 02:35:46 +02:00
van Hauser	c2260d2c5d	Merge pull request #574 from ddeka2910/master Add architecture ppc64le to travis build	2020-10-20 17:53:21 +02:00
ddeka2910	2d0723b281	Add architecture ppc64le to travis build	2020-10-20 21:04:31 +05:30
ddeka2910	be654c6bac	As is	2020-10-20 21:02:17 +05:30
van Hauser	927ed229f2	Merge pull request #571 from g3offrey/master html_encode the + character	2020-10-16 16:24:46 +02:00
van Hauser	631a61be8e	fix http-post-form optional parameter parsing	2020-10-16 13:49:07 +02:00
owein	e69f06ef62	this should be the last commit	2020-10-10 19:49:02 +02:00
owein	9edbcd3c36	slight modif that fixes all	2020-10-10 18:52:04 +02:00
owein D	033c881f8f	implement rain	2020-10-08 04:10:54 +02:00
owein D	fdb1c09c8e	if current < 4	2020-10-05 14:45:40 +02:00
owein D	fc82b52505	working algo after a change	2020-10-05 14:37:04 +02:00
Geoffrey	bbab443f88	html_encode the + character	2020-10-02 16:44:10 +02:00
owein D	490bd3e7cd	avoid negative values for the rotation variable	2020-09-30 10:19:10 +02:00
owein D	c65e3a26fc	update efficient rain option	2020-09-29 21:01:13 +02:00
owein	3fa6d372cf	fixed min length	2020-09-11 11:59:20 +02:00
owein	14ee7f2c83	typos again, too much copies and pastes...	2020-09-10 13:02:46 +02:00
e2002e	60a9924547	Merge branch 'master' into master	2020-09-10 12:52:26 +02:00
owein	2514335bf9	clean	2020-09-10 12:45:35 +02:00
owein	a6a87f11f4	fixed rotation broken due to a typo.	2020-09-10 10:57:06 +02:00
owein	fd8e83d0b1	done	2020-09-09 21:36:30 +02:00
owein	0e4913a7c1	help menu ok	2020-09-09 18:38:07 +02:00
owein	3742af00bb	rebranded the bruteforce variation method	2020-09-09 18:34:40 +02:00
van Hauser	78387c1ab1	Merge pull request #553 from maaaaz/msys2 MSYS2 support	2020-08-16 13:43:23 +02:00
maaaaz	84e765d3a9	msys support	2020-08-16 04:10:38 -04:00
van Hauser	79fa70cfdb	fix with gcc10 and overriden CFLAGS	2020-08-02 07:12:19 +02:00
owein	ccd3a99765	rolled back the http-form parameters parsing. help for bfg's rain is in bfg's help now	2019-11-19 16:49:54 +01:00
owein	b34655617f	!!! I did not test the escapes in the miscptr !!!	2019-10-21 20:37:25 +02:00
owein	6dfd77a37d	fixed http-post	2019-10-21 20:11:38 +02:00
owein	ab4aa36fd0	rolled back head_init for http-post-form, still an issue with the display	2019-10-20 23:26:44 +02:00
owein	1658f4926f	it look like github wants to drive me mad	2019-10-07 14:20:02 +02:00