v3.7.0

Nullock v3.7.0 — the academy + platform-completion release. A free, self-hosted alternative to Burp Suite Pro: MITM proxy, a full active-testing battery, network recon with CVE correlation, OAST, and a CI security gate — no telemetry, no license server.

Highlights

• 50-lab Web Security Academy — labs/01…labs/50, each a single-file intentionally-vulnerable app mapped to a Nullock probe (XSS, SQLi, SSRF, XXE, IDOR, OAuth, GraphQL, deserialization, cache poisoning/deception…), verified end-to-end against its detector.
• OWASP injection family completed — LDAP + XPath injection, fetch-proven SSRF (cloud-metadata / file:// / internal), insecure deserialization (Java/PHP/Python/Ruby/.NET), active JWT attacks (alg:none / not-verified / weak-secret / RS256→HS256), cross-site WebSocket hijacking, host-header injection, and server-side prototype pollution.
• OAST out-of-band auto-confirmation — nullock oast blast sprays blind SSRF / OS-command-injection / XXE / Log4Shell; an in-process HTTP or DNS callback auto-confirms the class via the correlator.
• Standalone deployable servers — nullock-oast (public callback sink) and nullock-workspace (team findings-sync, SQLite + bearer auth), both Dockerized with deploy guides.
• Recon & discovery — certificate transparency (crt.sh), soft-404-calibrated content/directory discovery, CSRF-PoC generator, and copy-as-curl.
• CVE accuracy pass — every curated CVE web-verified against NVD/vendor advisories; every finding kind now enriches to CWE/OWASP.

Each feature shipped with an adversarial code review and a regression test.

Install

• Windows — Nullock-3.7.0-win64.exe, run it.
• macOS — Nullock-3.7.0-Darwin.dmg; right-click → Open the first time (not yet notarized).
• Linux — .deb (sudo apt install ./Nullock-3.7.0-Linux.deb), .rpm (sudo dnf install ./Nullock-3.7.0-Linux.rpm), or the portable .tar.gz.

Then trust the CA it generates, point your browser's proxy at 127.0.0.1:8080, and set a scope before you browse. Full quickstart: https://bikebrainz.github.io/Nullock/docs/index.html

Full changelog: https://github.com/Bikebrainz/Nullock/blob/HEAD/CHANGELOG.md