! Development moved to a public github repository: https://github.com/vanhauser-thc/thc-hydra
        
        * David Maciejak, my co-maintainer moved to a different job and country and can not help with Hydra anymore - sadly! Wish you all the best!
        * Added patch from Ander Juaristi which adds h/H header options for http-form-*, great work, thanks!
        * Found login:password combinations are now printed with the name specified (hostname or IP), not always IP
        * Fixed the -M option, works now with many many targets :-)
        * -M option now supports ports, add a colon in between: "host:port", or, if IPv6, "[ipv6ipaddress]:port"
        * Fixed for cisco-enable if an intial Login/Password is used (thanks to joswr1te for reporting)
        * Added patch by tux-mind for better MySQL compilation and an Android patches and Makefile. Thanks!
        * Added xhydra gtk patches by Petar Kaleychev to support -h, -U, -f, -F, -q and -e r options, thanks!
        * Added patch for teamspeak to better identify server errors and auth failures (thanks to Petar Kaleychev)
        * Fixed a crash in the cisco module (thanks to Anatoly Mamaev for reporting)
        * Small fix for HTTP form module for redirect pages where a S= string match would not work (thanks to mkosmach for reporting)
        * Updated configure to detect subversion packages on current Cygwin
        * Fixed RDP module to support the port option (thanks to and.enshin(at)gmail.com)

PREREQUISITES

• A web server with PHP >= 4.1
• Log files in standard netfilter, ipfilter, ipfw, ipchains or Windows XP® format or database logs populated with the ULOG or NFLOG target of netfilter, or other database logs mapped with a view to ulogd version 1 or 2 schemas
• A MySQL or PostgreSQL database server:
• MySQL >= 3.23.52 or any production release of 4.x or 5.x
• MySQL >= 5 required for IPv6
• PostgreSQL >= 7.1
• PostgreSQL >= 7.4 required for IPv6
• Your favorite web browser.

Changelog v1.0

• Add support for ulogd version 2.
• Add support for snort database logs.
• Add support for Cisco IOS and Cisco PIX log formats (syslog).
• Add support for snort log files (syslog).
• Add support for netscreen log files (syslog).
• Add support for multiple table/view selection (database).
• Add IPv6 support for database logs, netfilter and ipfilter.
• Add support for RFC 5424 dates in netfilter log files.
• Add ip protocol number / name in ip headers section on packet detail page.
• Accept numeric criteria in binary notation (0b10010100)
• Output numeric fields in configurable format (decimal, hex, octal, binary).
• Substantial performance improvement with database logs.
• Only print fields on packet detail page where data exists.
• Only populate cache for fields appearing in report.
• Add option to populate cache for fields even when not in report.
• Work natively with postgresql inet column type.
• Implement php mysqli interface and use it when present.
• Test icmp_gateway column type separately from ip_saddr (database).
• For protocol-specific criteria/match, only check/display when relevant.
• Always use oob_time_sec when local_time does not exist (database).
• Add config parameter to set timezone if not set in php.ini (PHP >= 5.1).
• Sort blank source and destination port last for syslog (to match database).
• Fix matching by tcp options when not exact match (syslog).
• Fix parsing of ipfilter icmp code names.
• Fix display of service names to ‘-’ when name doesn’t resolve(database logs).
• Fix state maintenance when using alternate data source.
• Fix display of oob time to use date format string (database).
• Fix display of icmp gateway on packet detail page.
• Fix mysql and postgresql setup scripts for sample reports on some systems.
• Fix drill-down with arbitrary column defined in some cases (database).
• Fix page refresh when running report from report editor.
• Fix harmless PHP notice-level messages about undefined indexes, etc.
• Fix for netfilter when kernel logs uptime (syslog).
• Fix for Cisco PIX ID string variations.
• Gracefully continue on home page/report editor if no log table or view found.
• Remove outmoded option to update all in cache (database).
• Do not require or allow “AND” at start of additional WHERE clause (database).
• Use pcre instead of deprecated ereg functions internally.
• Allow trailing comments in conf file.
• Build system: use automake
• HTML fixes.
• Fix compiler warnings.
• Code cleanup.
• Documentation updates.

Changelog for hydra
-------------------

Release 8.0
! Development moved to a public github repository: https://github.com/vanhauser-thc/thc-hydra
* Added module for redis (submitted by Alejandro Ramos, thanks!)
* Added patch which adds Unicode support for the SMB module (thanks to Max Kosmach)
* Added initial interactive password authentication test for ssh (thanks to Joshua Houghton)
* Added patch for xhydra that adds bruteforce generator to the GUI (thanks to Petar Kaleychev)
* Target on the command line can now be a CIDR definition, e.g. 192.168.0.0/24
* with -M , you can now specify a port for each entry (use "target:port" per line)
* Verified that hydra compiles cleanly on QNX / Blackberry 10 :-)
* Bugfixes for -x option:
  - password tries were lost when connection errors happened (thanks to Vineet Kumar for reporting)
  - fixed crash when used together with -e option 
* Fixed a bug that hydra would not compile without libssh (introduced in v7.6)
* Various bugfixes if many targets where attacked in parallel
* Cygwin's Postgresql is working again, hence configure detection re-enabled
* Added gcc compilation security options (if detected to be supported by configure script)
* Enhancements to the secure compilation options
* Checked code with cppcheck and fixed some minor issues.
* Checked code with Coverity. Fixed a lot of small and medium issues.

• Build issue: Now using autotools to identify if sys/utsname.h is present.
• Changed configure.ac version to 2.8

Changelog v2.8.0-rc1:

• JSON Parser is no longer under tests. Now it is part of our mainline.
• Connection limits (SecConnReadStateLimit/SecConnWriteStateLimit) now support white and suspicious list.
• New variables: FULL_REQUEST and FULL_REQUEST_LENGTH were added, allowing the rules to access the full content of a request.
• ModSecurity status is now part of our mainline.
• New operator: @detectXSS was added. It makes usage of the newest libinjection XSS detection functionality.
• Append and prepend are now supported on nginx (Ref: #635);
• SecServerSignature is now available on nginx (Ref: #637);

• Regression tests are not able to expect different values according to the platform;
• Visual C++ 12/10 runtime dependencies are now part of the IIS installer, no need to have it installed prior ModSecurity installation (Ref: #627);
• New script was added to the IIS versions to identify whenever there is a missing dependency (available through the Application Menu);
• Memory usage improvement: using correct memory pools according to the context (Ref: #618, #620,#619);
• Independent API call to free the connection allocations, independently from the request objects, improvements on Nginx performance, vide issue for more information (Ref: #620, #648);
• IIS installer is now using the correct 32/64bits folders to install;
• IIS Installer 32bits now refuses to install on 64bits environments;
• IIS: Using new WiX options to build the package in the correct architecture;
• While installing IIS version the installer will remove old ModSecurityIIS configuration or files before proceed with the installation, avoiding further errors;
• CRS from IIS version was upgraded to 2.2.9;
• IIS installer does not support repair anymore, in fact it was not working already and it is now disabled;
• ModSecurity now warns the user who tries to use “proxy” in IIS or Nginx. Proxy is Apache only;
• Remove warnings from the build process (Ref: #617);
• Apache configuration in regression tests was changed making it more platform independent;
• Reduced the amount of warnings during the compilation (Ref: #385a2828e87897bd611bd2a519727ef88dc6d632, #1e63e49db4a592d28e08a33fc60750c37a3886fe);
• Regression tests were refactored to be more Nginx friendly;
• Fixed some regression tests that were not being flexible to handle multiple platforms: (Ref #636);
  • Fixed config/00-load-modsec.t test case. Now it expects for Nginx loaded message as it does for Apache. (Ref: #643);
  • Fixed mixed/10-misc-directives.t. Now it does not expect for SecServerSignature on the logs, just in the headers as the Nginx does in silence;
  • Fixed tnf/10-tfn-cache.t, action/10-logging.t, config/10-misc-directives.t, config/10-request-directives.t, misc/00-multipart-parser.t , misc/10-tfn-cache.t, rule/20-exceptions.t, rule/00-basics.t, rule/10-xml.t;
  • Increased the timeout while reading the auditlog;
  • SecAuditLogType Concurrent was removed from the regression test case, not compatible with all ports yet;
  • Regression tests were speeded up, as the number of tests are growing it is impossible to have it slow;
  • Fixed regression tests scripts paths, to make it MacOS friendly;
  • Avoiding dead locks on Nginx regression tests by enforcing a timeout whenever a request appears to fail;
• Updates to fix errors found by Parfait static code analysis (Ref: #612);
• Cleaning up on the repository, by removing unused files;
• IIS installer now supports to perform the installation without register the DLL on the system. It means that the user can download our MSI installer as it was a tarball archive (Ref #629, #624);
• IIS now support 32bits and 64bits pools, both are registered on IIS (Ref #628).

• Correctly handling inet_pton in IIS version;
• Nginx was missing a terminator while the charset string was mounted (Ref: #148);
• Added mod_extract_forwarded.c to run before mod_security2.c (Ref: #594);
• Added missing environment variables to regression tests;
• Build system is now more flexible by looking at liblua at: /usr/local/lib;
• Fixed typo in README file.
• Removed the non standard compliant HTTP response status code 44 from modsecurity recommended file (Ref: #665);
• Fixed segmentation fault if it fails to write on the audit log (Ref: #668);
• Not rejecting a larger request with ProcessPartial. Regression tests were also added (Ref: #597);
• Fixed UF8 to unicode conversion. Regression tests were also added(Ref: #672);
• Avoiding segmentation fault by checking if a structure is null before access its members;
• Removed double charset-header that used happen due a hardcoded charset in Nginx implementation (Ref: #650);
• Now alerting the users that there is no memory to proceed loading the configuration instead of just die;
• If SecRuleEngine is set to Off and SecRequestBodyAccess On Nginx returns error 500. Standalone is now capable to identify whenever ModSecurity is enabled or disabled, independently of ModSecurity core (Ref: #645);
• Fixed missing headers on Nginx whenever SecResponseBodyAccess was set to On and happens to be a filter on phase equals or over 3. (Ref #634);
• IIS is now picking the correct version of AppCmd while uninstalling or installing ModSecurityISS. (Ref#632).

2.1.0 - Major release

• New Module (sfp_malcheck): Identify whether an IP or domain (target, co-host or affiliate) appears on any malicious domain lists, RBLs, etc.
• New Module (sfp_bingsearch): Bing searches, as well as identifying co-hosted sites on the target's IPs
• New Module (sfp_affilinfo): Obtain information about affiliates
• New Module (sfp_strangeheaders): Identify non-standard HTTP headers
• Module overhaul (sfp_ripe, now sfp_ir): Identifies ISPs / Up-streams, BGP ASs, and much smarter at identifying owned netblocks
• Module overhaul (sfp_searchtld, now sfp_tldsearch): Uses the Mozilla public TLD list for identifying all TLDs.
• UI Enhancement: Option to configure a new scan by results desired in addition to modules
• UI Enhancement: Simple visualizations added
• UI Enhancement: Improved configuration section
• Lots of small tweaks, performance improvements, bug fixes

1. No changes to existing network. It only takes a few minutes to add ModSecurity to your existing web servers. And because it was designed to be completely passive by default, you are free to deploy it incrementally and only use the features you need. It is equally easy to remove or deactivate it should decide you don't want it any more.
2. No single point of failure. Unlike with network-based deployments, you will not be introducing a new point of failure to your system.
3. Implicit load balancing and scaling. Because it works embedded in web servers, ModSecurity will automatically take advantage of the additional load balancing and scalability features. You will not need to think of load balancing and scaling unless your existing system needs them.
4. Minimal overhead. Because it works from inside the web server process there is no overhead for network communication and minimal overhead in parsing and data exchange.
5. No problem with encrypted or compressed content. Many IDS systems have difficulties analysing SSL traffic. This is not a problem for ModSecurity because it is positioned to work when the traffic is decrypted and decompressed.

• SQL shell
• Uploader

• Admin page checker and preview
• Brute forcer (md5 mysql...)
• Coder (encode decode base64 hex md5...)

• Distant file reading
• Webshell deposit
• Terminal for webshell commands
• Configuration backup
• Update checker

• Time based algorithm
• Multi-thread control (start/pause/resume/stop)
• Shows URL calls

• GET, POST, header, cookie methods
• Normal, error based, blind algorithms
• Automatic best algorithm selection
• Progression bars
• Simple evasion
• Proxy setting
• Supports MySQL