diff --git a/cracker/sshprank/README.md b/cracker/sshprank/README.md
index d280d74..0a55da6 100644
--- a/cracker/sshprank/README.md
+++ b/cracker/sshprank/README.md
@@ -20,7 +20,7 @@ usage
 
   sshprank <mode> [opts] | <misc>
 
-modes
+mode options
 
   -h <hosts[:ports]>    - single host or host list to crack. multiple ports
                           can be separated by comma, e.g.: 127.0.0.1:22,222,2022
@@ -46,31 +46,53 @@ modes
                           format: <host>[:ports]. multiple ports can be
                           separated by comma (default port: 22)
 
-options
+scan options
 
   -r <num>              - generate <num> random ipv4 addresses, check for open
                           sshd port and crack for login (only with -m option!)
+
+credential options
+
   -u <user|file>        - single username or user list (default: root)
   -p <pass|file>        - single password or password list (default: root)
   -c <file>             - list of user:pass combination
+
+brute options
+
+  -e                    - exclude host after first login was found. continue
+                          with other hosts instead
+  -E                    - exit sshprank completely after first login was found
+  -z                    - shuffle target list randomly before cracking
+                          (only with -h <file>). saves to 'random_targets.txt'
+  -Z <num>              - random brute: pick random target + creds each attempt.
+                          <num> total attempts, 0 = infinite (use with -h, -u/-p)
+
+exec options
+
   -C <cmd|file>         - read commands from file (line by line) or execute a
                           single command on host if login was cracked
   -N                    - do not output ssh command results
+
+thread options
+
   -x <num>              - num threads for parallel host crack (default: 50)
   -S <num>              - num threads for parallel service crack (default: 20)
   -X <num>              - num threads for parallel login crack (default: 5)
   -B <num>              - num threads for parallel banner grabbing (default: 70)
+
+timeout options
+
   -T <sec>              - num sec for auth and connect timeout (default: 5s)
   -R <sec>              - num sec for (banner) read timeout (default: 3s)
+
+output options
+
   -o <file>             - write found logins to file. format:
                           <host>:<port>:<user>:<pass> (default: owned.txt)
-  -e                    - exclude host after first login was found. continue
-                          with other hosts instead
-  -E                    - exit sshprank completely after first login was found
   -v                    - verbose mode. show found logins, sshds, etc.
                           (default: off)
 
-misc
+misc options
 
   -H                    - print help
   -V                    - print version information
@@ -78,7 +100,7 @@ misc
 examples
 
   # crack targets from a given list with user admin, pw-list and 20 host-threads
-  $ sshprank -h sshds.txt -u admin -P /tmp/passlist.txt -x 20
+  $ sshprank -h sshds.txt -u admin -p /tmp/passlist.txt -x 20
 
   # first scan then crack from founds ssh services using 'root:admin'
   $ sudo sshprank -m '-p22,2022 --rate 5000 --source-ip 192.168.13.37 \
@@ -94,6 +116,15 @@ examples
 
   # grab banners and output to file with format supported for '-h' option
   $ sshprank -b hosts.txt > sshds2.txt
+
+  # shuffle target list and crack
+  $ sshprank -h sshds.txt -z -u root -p /tmp/passes.txt
+
+  # random brute: 500 random attempts from ip/user/pass lists
+  $ sshprank -h sshds.txt -u /tmp/users.txt -p /tmp/passes.txt -Z 500
+
+  # random brute infinite (ctrl+c to stop)
+  $ sshprank -h sshds.txt -u /tmp/users.txt -p /tmp/passes.txt -Z 0
 ```
 
 # Author
@@ -103,9 +134,12 @@ noptrix
 # Notes
 
 - quick'n'dirty code
-- sshprank is already packaged and available for [BlackArch Linux](https://www.blackarch.org/)
-- My master-branches are always stable; dev-branches are created for current work.
-- All of my public stuff you find are officially announced and published via [nullsecurity.net](https://www.nullsecurity.net).
+- sshprank is already packaged and available for [BlackArch
+  Linux](https://www.blackarch.org/)
+- My master-branches are always stable; dev-branches are created for current
+  work.
+- All of my public stuff you find are officially announced and published via
+  [nullsecurity.net](https://www.nullsecurity.net).
 
 # License
 
diff --git a/scanner/httpgrep/README.md b/scanner/httpgrep/README.md
index f464a6e..acac641 100644
--- a/scanner/httpgrep/README.md
+++ b/scanner/httpgrep/README.md
@@ -20,7 +20,7 @@ usage
 
   httpgrep -h <args> -s <arg> [opts] | <misc>
 
-opts
+target options
 
   -h <hosts|file>   - single host/url or host-/cidr-range or file containing
                       hosts or file containing URLs, e.g.: foobar.net,
@@ -29,27 +29,47 @@ opts
                       file.
   -p <port>         - port to connect to (default: 80 if hosts were given)
   -t                - use TLS/SSL to connect to service
-  -u <URI>          - URI to search given strings in, e.g.: /foobar/, /foo.html
-                      (default: /)
-  -s <str|file>     - a single string/regex or multile strings/regex in a file
-                      to find in given URIs and HTTP response headers,
-                      e.g.: 'tomcat 8', '/tmp/igot0daysforthese.txt'
-  -S <where>        - search strings in given places (default: headers,body)
+  -u <URI|file>     - URI or comma-separated URIs or file with URIs (one per
+                      line) to search given strings in, e.g.: /foobar/,
+                      /foo.html, /admin,/login, /tmp/paths.txt (default: /)
+  -r                - perform reverse dns lookup for given IPv4 addresses
+                      NOTE: this will slow down the scanz
+
+http options
+
   -X <method>       - specify HTTP request method to use (default: get).
                       use '?' to list available methods.
   -a <user:pass>    - http auth credentials (format: 'user:pass')
   -U <UA>           - set custom User-Agent (default: firefox, rv84, windows)
+  -A                - use random user-agent per request
+  -R <headers>      - set custom headers (format: 'foo=bar;lol=lulz;...')
+  -C <cookies>      - set cookies (format: 'foo=bar;lol=lulz;...')
+  -F                - don't follow HTTP redirects
+  -P <proxy>        - use proxy (format: '[http|https|socks4|socks5]://host:port')
+
+search options
+
+  -s <str|file>     - a single string/regex or multile strings/regex in a file
+                      to find in given URIs and HTTP response headers,
+                      e.g.: 'tomcat 8', '/tmp/igot0daysforthese.txt'
+  -S <where>        - search strings in given places (default: headers,body)
   -b <bytes>        - num bytes to read from response. offset == response[0].
                       (default: 64)
+  -i                - use case-insensitive search
+
+scan options
+
   -x <threads>      - num threads for concurrent scans and checks (default: 80)
   -c <seconds>      - num seconds for socket timeout (default: 3.0)
-  -i                - use case-insensitive search
-  -r                - perform reverse dns lookup for given IPv4 addresses
-                      NOTE: this will slow down the scanz
+  -f <codes>        - only report responses with given HTTP status codes,
+                      e.g.: '200', '200,301,302'
+
+output options
+
   -l <file>         - log found matches to file
   -v                - verbose mode (default: quiet)
 
-misc
+misc options
 
   -H                - print help
   -V                - print version information
diff --git a/scanner/httpgrep/release/httpgrep-2.4.tar.gz b/scanner/httpgrep/release/httpgrep-2.4.tar.gz
deleted file mode 100644
index 6338a43..0000000
Binary files a/scanner/httpgrep/release/httpgrep-2.4.tar.gz and /dev/null differ
diff --git a/scanner/httpgrep/release/httpgrep-2.6.tar.gz b/scanner/httpgrep/release/httpgrep-2.6.tar.gz
new file mode 100644
index 0000000..03f44cf
Binary files /dev/null and b/scanner/httpgrep/release/httpgrep-2.6.tar.gz differ