Fixing up Net-Creds

The report details how incorrect HTTP header parsing and a misordered function call in MITMf/net-creds caused NTLMSSP challenges in HTTP 407 Proxy-Authenticate responses to be missed, resulting in “CHALLENGE NOT FOUND” during ARP spoof/WPAD MITM credential harvesting. After analyzing traffic with Wireshark, the author rewrote the header-parsing logic to account for HTTP response first-line handling and corrected the argument order, restoring proper extraction of full NETNTLMv2 hashes on Windows 10 networks. The fixes were submitted and accepted in both MITMf and net-creds, enabling reliable proxy-auth–based credential capture.