Next | Query returned 22 messages, browsing 11 to 20 | Previous

History of commit frequency

CVS Commit History:


   2023-09-17 14:12:59 by Leonardo Taccari | Files touched by this commit (3)
Log message:
nuclei: Update to 2.9.15

Changes:
v2.9.15
* Bug fixes

v2.9.14
* Added `impact` field under template information block

v2.9.13
* Added support to run public / shared template from templates.nuclei.sh with \ 
`-t` option
* Added `xpath` as new matcher type
* Added file read restriction in headless protocol similar to other protocols

v2.9.12
* Bug fixes

v2.9.11
* Added request/response in JSONL output for failed match with `-ms` option

v2.9.10
* Added markdown export sorting options via env variable
* Added headless options input
* Added wildcard filter for `-id` option
* Added path/query automerge and other improvements in headless protocol
   2023-09-08 21:06:15 by Benny Siegert | Files touched by this commit (154) | Package updated
Log message:
Revbump all Go packages after go120 update
   2023-08-26 18:31:41 by Benny Siegert | Files touched by this commit (149) | Package updated
Log message:
Revbump all Go packages after go120 update
   2023-07-23 18:06:48 by Leonardo Taccari | Files touched by this commit (1)
Log message:
nuclei: Remove XXX comment

It was used only as an excuse to provide the right commit message.
   2023-07-23 18:04:48 by Leonardo Taccari | Files touched by this commit (1) | Package updated
Log message:
nuclei: Update to 2.9.9

(Previous commit was wrong, add an XXX comment just as an excuse to
provide right commit message, sorry!)

Changes:
v2.9.9 (Security Update)

## What's Changed
### Features

* Added env variable support to disable automatic template update from specifc \ 
source:

```console
export DISABLE_NUCLEI_TEMPLATES_PUBLIC_DOWNLOAD=true # Disable download from the \ 
default nuclei-templates project
export DISABLE_NUCLEI_TEMPLATES_GITHUB_DOWNLOAD=true # Disable download from \ 
public / private GitHub project(s)
export DISABLE_NUCLEI_TEMPLATES_GITLAB_DOWNLOAD=true # Disable download from \ 
public / private GitLab project(s)
export DISABLE_NUCLEI_TEMPLATES_AWS_DOWNLOAD=true # Disable download from public \ 
/ private AWS Bucket(s)
export DISABLE_NUCLEI_TEMPLATES_AZURE_DOWNLOAD=true # Disable download from \ 
public / private Azure Blob Storage
```

* Added helper function to calculate jarm hash:

```yaml
{{jarm("1.1.1.1:443")}}
```

* Added support for `disable-path-automerge` in unsafe mode
* Added request/reponse in include in result as default
* Added `epss-percentile` attribute template classification section

```yaml
  classification:
    epss-percentile: 0.00064
```

* Added option to optionally exclude request/reponse in results

```console
   -or, -omit-raw  omit request/response pairs in the JSON, JSONL, and
		   Markdown outputs (for findings only)
```

* Added automatic target merge in network templates

### Bugs
* Fixed issue in workflow concurrency

### Maintenance
* Fixed issue in the payload generator

### Other Changes
* Added ztls fallback support as default for tls connection

### Security (breaking change)

* Fixed issue with payloads loading in sandbox mode
* Disabled payload loading from arbitrary location as default
* Added option to disable network connection to local / private

```
   -lfa, -allow-local-file-access        allows file (payload) access anywhere \ 
on the system
   -lna, -restrict-local-network-access  blocks connections to the local / \ 
private network
```

### Deprecated

- `-sandbox` option (now brokedown into two new option `-lfa`, `-lna`)
- `-irr, -include-rr` option (now enabled as default)

v2.9.8
## What's Changed
### Bugs
* Fixed issue to preserve the order of query parameters
* Fixed with network connection read and write deadline
* Fixed issue with showing multiple matches per template with `-ms` option

v2.9.7
## What's Changed
### Features
* Added tls client hello (ja3) randomization

```
   -tlsi, -tls-impersonate  enable experimental client hello (ja3) tls randomization
```

* Added query fuzzing support in headless protocol
* Added cookie reuse in workflow for headless template
* Added `header` and `status` matchers to headless protocol
* Added `{{public_ip()}}` helper function
* Added template option (`disable-path-automerge: true`) to disable path
  automerge in raw request

### Bugs
* Fixed issue with tls protocol causing scan to stuck
* Fixed `panic: runtime error`
* Fixed issue in file protocol with matchers and condition
* Fixed output path in unsafe mode
* Fixed rendering issues with markdown and jira exporter
* Fixed issue custom client certificate input

### Maintenance
* Added better debug message formatting
* Fixed `deprecatedProtocolNameTemplates` concurrent map writes
* Enabled `-no-httpx` implicitly  when `-passive` scan is launched

v2.9.6
## What's Changed
### Bug Fixes

* Fixed issue with uncover config loader
* Fixed issue with template update option

### Breaking Change

* Fixed typo (breaking change for using as SDK)

### Maintenance
* Updated TCP protocol

v2.9.5
## What's Changed
* Added payloads support in dns protocol
* Added `any` type query support in dns protocol
* Added support for constants
* Added utility to write `max-requests` counter to templates
* Fixed memory leak (high memory uses)
* Fixed issue with interactsh (probably evicted due to inactivity)
* Fixed issue with removing semicolon from raw request
* Fixed typos
* Fixed oob ruleindex
* Fixed updates to docs references
* Updated uncover integration logic
* Removed `.yml` extension support for template input as URL

v2.9.4
## What's Changed
* Added option for nuclei templates / config reset

```console
   -reset  reset removes all nuclei configuration and data files (including \ 
nuclei-templates)
```

v2.9.3 (bugfix release)
## What's Changed
* Added support to expose DNS response as dsl field
* Added support to filter templates based on classification
* Added check to make `severity` as a mandatory field
* Added support to load templates deprecated path
* Added warning message for templates loaded
* Added warning message for templates loaded with deprecated protocol syntax
* Added option to save extractor result to file
* Fixed nil pointer crash in interactsh client
* Fixed crash with tlsx integration
* Fixed crash with `no-interactsh` option
* Fixed panic while parsing tlsx response
* Fixed issue with params in self-contained template
* Fixed issue with aws signer
* Fixed issue with os permission check
* Fixed issue with no color in windows
* Fixed issue with variables evaluation
* Fixed issue to support headless template on OpenBSD
   2023-07-23 18:02:22 by Leonardo Taccari | Files touched by this commit (3)
Log message:
httpx: Update to 1.3.4

Changes:
v1.3.4
### Features
* Added error page classifier with automatic filtering

```console
   -fep, -filter-error-page  filter response with ML based error page detection
```

* Added support for multiple output format

```console
   -oa, -output-all  filename to write output results in all formats
```

* Added html index (`screenshot.html`) file for screenshots
* Added custom config input support

```console
   -config string  path to the httpx configuration file (default \ 
$HOME/.config/httpx/config.yaml)

### Bugs
* Fixed `-tls-grab` option issue in ztls mode
* Fixed issue with `-sr` option when used with `-x` option

### Maintenance
* Made output response fields public

### Other Changes
* Fixed github.com/bxcodec/faker/v4 is deprecated

v1.3.3
### Features
* Added Support for TLS ClientHello randomization (experimental)
```console
   -tlsi, -tls-impersonate  enable experimental client hello (ja3) tls randomization
```

### Bugs
* Fixed issue with `rateLimiter` not stop
* Fixed issue to skip body read with status code 304
* Fixed issue to remove duplicate `onresult` option

v1.3.2
### Bugs
* Fixed issue ignoring http path with port option
* Fixed issue to write missing screenshots to index file

### Other Changes
* Added `-no-stdin` option
   2023-07-15 12:53:10 by Benny Siegert | Files touched by this commit (151) | Package updated
Log message:
Revbump all Go packages after go120 update
   2023-05-05 21:37:45 by Benny Siegert | Files touched by this commit (134) | Package updated
Log message:
Revbump all Go packages after go120 security update
   2023-04-24 15:33:10 by Leonardo Taccari | Files touched by this commit (3) | Package updated
Log message:
nuclei: Update to 2.9.2

Changes:
2.9.2
-----
## What's Changed
* Added `llm_prompt` as dsl helper
* Added **azure blob storage** support for custom template download
* Added **gitlab project** support for custom template download
* Added CPE / EPSS Score information to cve-annotation
* Added variable evaluation support in payloads & variables
* Added config management + logic refactor
* Added JSONL(ine) Export (`-je, -json-export string` -- file to export
  results in JSON format)
* Fixed bug in http race condition logic
* Fixed s3 argument typos
* Fixed integration test
* Fixed rate limit options not working with query fuzzing
* Fixed panic crash in tlsx
* Fixed panic with proxy input
* Updated `-nc` option
* Updated `ccache` with generic gcache
* Updated `-un` option to `-up` as a short flag of self-update option
   2023-04-05 22:48:01 by Benny Siegert | Files touched by this commit (140) | Package updated
Log message:
Revbump all Go packages after yesterday's go120 security update

Next | Query returned 22 messages, browsing 11 to 20 | Previous