2023-09-17 14:12:59 by Leonardo Taccari | Files touched by this commit (3) |
Log message:
nuclei: Update to 2.9.15
Changes:
v2.9.15
* Bug fixes
v2.9.14
* Added `impact` field under template information block
v2.9.13
* Added support to run public / shared template from templates.nuclei.sh with \
`-t` option
* Added `xpath` as new matcher type
* Added file read restriction in headless protocol similar to other protocols
v2.9.12
* Bug fixes
v2.9.11
* Added request/response in JSONL output for failed match with `-ms` option
v2.9.10
* Added markdown export sorting options via env variable
* Added headless options input
* Added wildcard filter for `-id` option
* Added path/query automerge and other improvements in headless protocol
|
2023-09-08 21:06:15 by Benny Siegert | Files touched by this commit (154) | |
Log message:
Revbump all Go packages after go120 update
|
2023-08-26 18:31:41 by Benny Siegert | Files touched by this commit (149) | |
Log message:
Revbump all Go packages after go120 update
|
2023-07-23 18:06:48 by Leonardo Taccari | Files touched by this commit (1) |
Log message:
nuclei: Remove XXX comment
It was used only as an excuse to provide the right commit message.
|
2023-07-23 18:04:48 by Leonardo Taccari | Files touched by this commit (1) | |
Log message:
nuclei: Update to 2.9.9
(Previous commit was wrong, add an XXX comment just as an excuse to
provide right commit message, sorry!)
Changes:
v2.9.9 (Security Update)
## What's Changed
### Features
* Added env variable support to disable automatic template update from specifc \
source:
```console
export DISABLE_NUCLEI_TEMPLATES_PUBLIC_DOWNLOAD=true # Disable download from the \
default nuclei-templates project
export DISABLE_NUCLEI_TEMPLATES_GITHUB_DOWNLOAD=true # Disable download from \
public / private GitHub project(s)
export DISABLE_NUCLEI_TEMPLATES_GITLAB_DOWNLOAD=true # Disable download from \
public / private GitLab project(s)
export DISABLE_NUCLEI_TEMPLATES_AWS_DOWNLOAD=true # Disable download from public \
/ private AWS Bucket(s)
export DISABLE_NUCLEI_TEMPLATES_AZURE_DOWNLOAD=true # Disable download from \
public / private Azure Blob Storage
```
* Added helper function to calculate jarm hash:
```yaml
{{jarm("1.1.1.1:443")}}
```
* Added support for `disable-path-automerge` in unsafe mode
* Added request/reponse in include in result as default
* Added `epss-percentile` attribute template classification section
```yaml
classification:
epss-percentile: 0.00064
```
* Added option to optionally exclude request/reponse in results
```console
-or, -omit-raw omit request/response pairs in the JSON, JSONL, and
Markdown outputs (for findings only)
```
* Added automatic target merge in network templates
### Bugs
* Fixed issue in workflow concurrency
### Maintenance
* Fixed issue in the payload generator
### Other Changes
* Added ztls fallback support as default for tls connection
### Security (breaking change)
* Fixed issue with payloads loading in sandbox mode
* Disabled payload loading from arbitrary location as default
* Added option to disable network connection to local / private
```
-lfa, -allow-local-file-access allows file (payload) access anywhere \
on the system
-lna, -restrict-local-network-access blocks connections to the local / \
private network
```
### Deprecated
- `-sandbox` option (now brokedown into two new option `-lfa`, `-lna`)
- `-irr, -include-rr` option (now enabled as default)
v2.9.8
## What's Changed
### Bugs
* Fixed issue to preserve the order of query parameters
* Fixed with network connection read and write deadline
* Fixed issue with showing multiple matches per template with `-ms` option
v2.9.7
## What's Changed
### Features
* Added tls client hello (ja3) randomization
```
-tlsi, -tls-impersonate enable experimental client hello (ja3) tls randomization
```
* Added query fuzzing support in headless protocol
* Added cookie reuse in workflow for headless template
* Added `header` and `status` matchers to headless protocol
* Added `{{public_ip()}}` helper function
* Added template option (`disable-path-automerge: true`) to disable path
automerge in raw request
### Bugs
* Fixed issue with tls protocol causing scan to stuck
* Fixed `panic: runtime error`
* Fixed issue in file protocol with matchers and condition
* Fixed output path in unsafe mode
* Fixed rendering issues with markdown and jira exporter
* Fixed issue custom client certificate input
### Maintenance
* Added better debug message formatting
* Fixed `deprecatedProtocolNameTemplates` concurrent map writes
* Enabled `-no-httpx` implicitly when `-passive` scan is launched
v2.9.6
## What's Changed
### Bug Fixes
* Fixed issue with uncover config loader
* Fixed issue with template update option
### Breaking Change
* Fixed typo (breaking change for using as SDK)
### Maintenance
* Updated TCP protocol
v2.9.5
## What's Changed
* Added payloads support in dns protocol
* Added `any` type query support in dns protocol
* Added support for constants
* Added utility to write `max-requests` counter to templates
* Fixed memory leak (high memory uses)
* Fixed issue with interactsh (probably evicted due to inactivity)
* Fixed issue with removing semicolon from raw request
* Fixed typos
* Fixed oob ruleindex
* Fixed updates to docs references
* Updated uncover integration logic
* Removed `.yml` extension support for template input as URL
v2.9.4
## What's Changed
* Added option for nuclei templates / config reset
```console
-reset reset removes all nuclei configuration and data files (including \
nuclei-templates)
```
v2.9.3 (bugfix release)
## What's Changed
* Added support to expose DNS response as dsl field
* Added support to filter templates based on classification
* Added check to make `severity` as a mandatory field
* Added support to load templates deprecated path
* Added warning message for templates loaded
* Added warning message for templates loaded with deprecated protocol syntax
* Added option to save extractor result to file
* Fixed nil pointer crash in interactsh client
* Fixed crash with tlsx integration
* Fixed crash with `no-interactsh` option
* Fixed panic while parsing tlsx response
* Fixed issue with params in self-contained template
* Fixed issue with aws signer
* Fixed issue with os permission check
* Fixed issue with no color in windows
* Fixed issue with variables evaluation
* Fixed issue to support headless template on OpenBSD
|
2023-07-23 18:02:22 by Leonardo Taccari | Files touched by this commit (3) |
Log message:
httpx: Update to 1.3.4
Changes:
v1.3.4
### Features
* Added error page classifier with automatic filtering
```console
-fep, -filter-error-page filter response with ML based error page detection
```
* Added support for multiple output format
```console
-oa, -output-all filename to write output results in all formats
```
* Added html index (`screenshot.html`) file for screenshots
* Added custom config input support
```console
-config string path to the httpx configuration file (default \
$HOME/.config/httpx/config.yaml)
### Bugs
* Fixed `-tls-grab` option issue in ztls mode
* Fixed issue with `-sr` option when used with `-x` option
### Maintenance
* Made output response fields public
### Other Changes
* Fixed github.com/bxcodec/faker/v4 is deprecated
v1.3.3
### Features
* Added Support for TLS ClientHello randomization (experimental)
```console
-tlsi, -tls-impersonate enable experimental client hello (ja3) tls randomization
```
### Bugs
* Fixed issue with `rateLimiter` not stop
* Fixed issue to skip body read with status code 304
* Fixed issue to remove duplicate `onresult` option
v1.3.2
### Bugs
* Fixed issue ignoring http path with port option
* Fixed issue to write missing screenshots to index file
### Other Changes
* Added `-no-stdin` option
|
2023-07-15 12:53:10 by Benny Siegert | Files touched by this commit (151) | |
Log message:
Revbump all Go packages after go120 update
|
2023-05-05 21:37:45 by Benny Siegert | Files touched by this commit (134) | |
Log message:
Revbump all Go packages after go120 security update
|
2023-04-24 15:33:10 by Leonardo Taccari | Files touched by this commit (3) | |
Log message:
nuclei: Update to 2.9.2
Changes:
2.9.2
-----
## What's Changed
* Added `llm_prompt` as dsl helper
* Added **azure blob storage** support for custom template download
* Added **gitlab project** support for custom template download
* Added CPE / EPSS Score information to cve-annotation
* Added variable evaluation support in payloads & variables
* Added config management + logic refactor
* Added JSONL(ine) Export (`-je, -json-export string` -- file to export
results in JSON format)
* Fixed bug in http race condition logic
* Fixed s3 argument typos
* Fixed integration test
* Fixed rate limit options not working with query fuzzing
* Fixed panic crash in tlsx
* Fixed panic with proxy input
* Updated `-nc` option
* Updated `ccache` with generic gcache
* Updated `-un` option to `-up` as a short flag of self-update option
|
2023-04-05 22:48:01 by Benny Siegert | Files touched by this commit (140) | |
Log message:
Revbump all Go packages after yesterday's go120 security update
|