[Pentesting] HTTP auth, part III: rogue web-server