ptai 1.1.0 — verification coverage + resilience
Roughly doubles the vulnerability classes ptai oracle-verifies, and fixes the bug that made a scan of a live vulnerable app report 0 verified.
Added
- Ten new verification oracles (each with a control that must fail on a safe target): trusted-header bypass, JWT
alg:none, host-header poisoning, XXE, type confusion, stored XSS, sequential IDOR, mass-assignment, non-blind SSRF, SQLi login-bypass. 14 distinct classes now verify. - Path-traversal oracle (
ptai demo→ 4 findings, all 4 oracle-VERIFIED).
Fixed
- Scope safety: active tools (sqlmap/dalfox) are host-locked to the engagement target; no more attacking third-party URLs scraped from a target's content.
- Verify resilience: the verify phase waits for a wobbled target to recover instead of failing every oracle against it. Took OWASP Juice Shop from 0 → 12 oracle-verified in a scan.
Validation
- Juice Shop scoped scan: 12 verified. Multi-vuln honeypot: 23 verified across 14 classes, 100% precision, 0 false positives. Reproducible (honeypot + clean-app gates in the repo).