Miroslav Štampar
d1ceaf9365
Fix for --param-exclude partially matching place names (e.g. 'ge' vs GET)
2026-11-12 14:44:50 +01:00
Miroslav Štampar
b48a14a63b
Fix for --sql-query splitting on ';' inside string literals
2026-11-12 14:32:41 +01:00
Miroslav Štampar
2d046c1a75
Fixes #6163
2026-10-29 14:15:37 +01:00
Miroslav Štampar
9b0e262560
Fix related to the #6149
/ build (macos-latest, 3.8) (push) Has been cancelled
/ build (ubuntu-latest, pypy-2.7) (push) Has been cancelled
/ build (windows-latest, 3.14) (push) Has been cancelled
2026-10-20 10:07:33 +02:00
Miroslav Štampar
d0ad9b2e34
Adding cross-DBMS security configuration audit (--audit)
2026-10-19 18:34:39 +02:00
Miroslav Štampar
e90078184d
Implements --links ( #21 )
2026-10-19 10:19:34 +02:00
Miroslav Štampar
9a1660aa12
Minor cleaning after #6146
/ build (macos-latest, 3.8) (push) Waiting to run
/ build (ubuntu-latest, pypy-2.7) (push) Waiting to run
/ build (windows-latest, 3.14) (push) Waiting to run
2026-10-17 13:06:38 +02:00
Bharath Vemula
0cf2f6db07
Fix REST API multi-target scans returning only the last target's results ( #2503 ) ( #6146 )
...
A scan covering multiple targets inside a single API task (crawl,
'-m' bulk file, forms) ran every target through one StdDbOut keyed by
the single taskid, so _storeData()'s COMPLETE branch deleted each
earlier target's TARGET/TECHNIQUES rows - /scan/<id>/data returned
only the last target's results.
Mirror the --report-json fix for #6123 : controller.start() now sets
kb.reportTaskId per target for API scans too, StdDbOut.write() keys
data rows '<taskid>-<n>' per target, and scan_data() folds the
per-target rows back into the task's flat result in target order.
Single-target scans keep the exact same response shape.
Regression tests in tests/test_api.py (TestStdDbOutMultiTarget,
TestScanDataMultiTarget).
2026-10-17 13:02:34 +02:00
Miroslav Štampar
c94f6d0041
Update regarding #6145
/ build (macos-latest, 3.8) (push) Has been cancelled
/ build (ubuntu-latest, pypy-2.7) (push) Has been cancelled
/ build (windows-latest, 3.14) (push) Has been cancelled
2026-10-16 12:15:59 +02:00
Miroslav Štampar
4d518ff813
Fixes #6132
/ build (macos-latest, 3.8) (push) Waiting to run
/ build (ubuntu-latest, pypy-2.7) (push) Waiting to run
/ build (windows-latest, 3.14) (push) Waiting to run
2026-09-28 09:01:30 +02:00
Miroslav Štampar
bda62dcf28
Fixes #6123
2026-09-18 00:41:57 +02:00
Miroslav Štampar
5f6c303f8a
Fixes #6108
/ build (macos-latest, 3.8) (push) Has been cancelled
/ build (ubuntu-latest, pypy-2.7) (push) Has been cancelled
/ build (windows-latest, 3.14) (push) Has been cancelled
2026-09-09 00:59:57 +02:00
Miroslav Štampar
1ee368f78a
Fixes #6105
/ build (macos-latest, 3.8) (push) Has been cancelled
/ build (ubuntu-latest, pypy-2.7) (push) Has been cancelled
/ build (windows-latest, 3.14) (push) Has been cancelled
2026-09-04 09:47:33 +02:00
Miroslav Štampar
1192d266c8
Update related to the #6099
/ build (macos-latest, 3.8) (push) Has been cancelled
/ build (ubuntu-latest, pypy-2.7) (push) Has been cancelled
/ build (windows-latest, 3.14) (push) Has been cancelled
2026-08-28 09:44:22 +02:00
Miroslav Štampar
cbe892410c
Adding more WAF friendly fingerprinting payloads
2026-08-17 14:25:46 +02:00
Miroslav Štampar
bdf3e09315
Adding support for multi-bit boolean extraction
2026-08-16 23:11:49 +02:00
Miroslav Štampar
e11ea65230
Minor patch
2026-08-11 23:13:20 +02:00
Miroslav Štampar
dd57fd91e2
Adding switches --odata and --sparql
2026-08-09 11:04:44 +02:00
Miroslav Štampar
881d2e8f90
Adding switch --xslt
2026-08-08 00:37:32 +02:00
Miroslav Štampar
39d22d26c3
Making boolean inference some more robust against jitter
/ build (macos-latest, 3.8) (push) Waiting to run
/ build (ubuntu-latest, pypy-2.7) (push) Waiting to run
/ build (windows-latest, 3.14) (push) Waiting to run
2026-07-29 02:13:39 +02:00
Miroslav Štampar
bb9e5dbf44
Fixing bug with --lengths and --null-connection combined
2026-07-27 17:22:17 +02:00
Miroslav Štampar
edbfca0b8e
Adding switch --jwt
/ build (macos-latest, 3.8) (push) Waiting to run
/ build (ubuntu-latest, pypy-2.7) (push) Waiting to run
/ build (windows-latest, 3.14) (push) Waiting to run
2026-07-25 22:40:12 +02:00
Miroslav Štampar
075d009bb7
Adding switch --mine-params
2026-07-24 14:27:05 +02:00
Miroslav Štampar
9925adf799
Adding tamper script sign
2026-07-21 13:33:53 +02:00
Miroslav Štampar
0cf4c641a1
Adding auto-between on > filtering
2026-07-21 13:16:40 +02:00
Miroslav Štampar
76b75e95f0
Improving dialect checks
2026-07-17 14:46:52 +02:00
Miroslav Štampar
57f8485279
Adding Esperanto DBMS agnostic engine
2026-07-16 18:13:32 +02:00
Miroslav Štampar
16cd9425ae
Introducing detection switch --lengths
2026-07-12 14:42:34 +02:00
Miroslav Štampar
921870ccf0
Adding embedded dbwire library
2026-07-12 10:32:57 +02:00
Miroslav Štampar
d0f16b284d
Adding support for --hql
2026-07-10 10:38:20 +02:00
Miroslav Štampar
1465d55a47
Merge branch 'master' into hana-pr
...
# Conflicts:
# data/txt/sha256sums.txt
# lib/core/common.py
# lib/core/settings.py
2026-07-09 16:48:30 +02:00
Miroslav Štampar
f46c463eba
Adding support for --timeless HTTP2 technique
2026-07-08 01:58:36 +02:00
Miroslav Štampar
6597415ab0
Minor update
/ build (macos-latest, 3.8) (push) Has been cancelled
/ build (ubuntu-latest, pypy-2.7) (push) Has been cancelled
/ build (windows-latest, 3.14) (push) Has been cancelled
2026-07-04 21:45:42 +02:00
Miroslav Štampar
5fa2da5eae
Adding support for --xxe
2026-07-04 09:53:04 +02:00
Miroslav Štampar
1716ad1524
Minor improvement of UNION detection
2026-07-01 22:31:37 +02:00
Miroslav Štampar
8a75c0bb62
Minor patch
2026-07-01 11:06:39 +02:00
Miroslav Štampar
d6b491dec4
Minor safety mechanism for HEAD null connection
2026-07-01 00:00:47 +02:00
Miroslav Štampar
92a9446c46
Minor optimization
2026-06-30 23:50:45 +02:00
Miroslav Štampar
74f90df8ae
Implementing extractStructuralTokens as a helper to detection engine
/ build (macos-latest, 3.8) (push) Waiting to run
/ build (ubuntu-latest, pypy-2.7) (push) Waiting to run
/ build (windows-latest, 3.14) (push) Waiting to run
2026-06-30 23:09:06 +02:00
Miroslav Štampar
87eb93db15
Minor update
2026-06-30 12:18:06 +02:00
Miroslav Štampar
820efa7a8a
Adding switch --ssti
2026-06-29 11:43:10 +02:00
Miroslav Štampar
8ff5d3811a
Adding switch --xpath
2026-06-29 00:29:27 +02:00
Miroslav Štampar
e8162d314a
Adding switch --ldap
/ build (macos-latest, 3.8) (push) Waiting to run
/ build (ubuntu-latest, pypy-2.7) (push) Waiting to run
/ build (windows-latest, 3.14) (push) Waiting to run
2026-06-28 01:36:38 +02:00
Miroslav Štampar
f6912fc921
Adding support for GraphQL (--graphql)
2026-06-27 19:23:30 +02:00
Miroslav Štampar
2893fd5c4d
Adding support for NoSQL injection
/ build (macos-latest, 3.8) (push) Has been cancelled
/ build (ubuntu-latest, pypy-2.7) (push) Has been cancelled
/ build (windows-latest, 3.14) (push) Has been cancelled
2026-06-24 22:57:09 +02:00
Miroslav Štampar
15715a2513
Adding switch --procs ( #778 )
2026-06-24 01:35:02 +02:00
Miroslav Štampar
8de9c5899d
Couple of improvements
2026-06-18 17:46:40 +02:00
Miroslav Štampar
002a28f7f0
Couple of bug fixes
/ build (macos-latest, 3.8) (push) Has been cancelled
/ build (ubuntu-latest, pypy-2.7) (push) Has been cancelled
/ build (windows-latest, 3.14) (push) Has been cancelled
2026-06-18 13:04:59 +02:00
Miroslav Štampar
1404133538
Add --prove, opt-in --auto-tamper WAF bypass, and blindbinary/infoschema2innodb tampers
2026-06-17 15:58:08 +02:00
Miroslav Štampar
75c4c868b4
Minor update
2026-06-15 21:14:10 +02:00
