Credentials hiding in plain sight or how I pwned your HTTP auth · HackerTrans