Skip to content

CatchClaw v5.1.0 — Multi-Target Scanning & Payload Enhancement

Choose a tag to compare

View all tags
@Coff0xc Coff0xc released this 23 Mar 18:01
· 12 commits to master since this release
v5.1.0
e7ebb6b

What's New in v5.1.0

Multi-Target Scanning

  • CIDR notation (--targets "192.168.1.0/24:8080")
  • IP range (--targets "10.0.0.1-10.0.0.50:8080")
  • Target file (-f targets.txt) — one host:port per line
  • Comma-separated (-t host1:8080,host2:443)
  • Bounded parallel scanning with configurable concurrency

Port Scanning & Service Discovery

  • TCP connect scan across common ports (80, 443, 3000, 8080, etc.)
  • OpenClaw fingerprinting via /api/v1/auths/, /health, /api/config, WebSocket /ws
  • Custom port ranges (--ports 8000-9000)

200+ External Payloads

  • payloads/ssrf.yaml — AWS/GCP/Azure/DigitalOcean metadata, IP bypass (0x7f000001, etc.), protocol smuggling (gopher, dict, file)
  • payloads/injection.yaml — Command injection, shell metachar, encoding bypass, template injection
  • payloads/prompt_inject.yaml — System prompt extraction, DAN jailbreak, role override, context overflow
  • payloads/auth_bypass.yaml — Token manipulation, header bypass, path traversal, default creds
  • payloads/xss.yaml — Reflected, event handlers, filter bypass, polyglot

CLI Enhancements

  • --profile — Select scan presets from catchclaw.toml (quick/stealth/full)
  • --severity-filter critical,high — Filter results by severity
  • --format html|markdown|json — Choose report output format
  • --dry-run — Preview DAG execution plan without scanning
  • Improved list output with numbered table
  • Scan config summary box before execution

Report Formats

  • HTML — Dark-themed, self-contained, XSS-safe report with summary cards
  • Markdown — GitHub-flavored with summary table and detailed findings
  • JSON — Existing structured output (now supports multi-target)

CI/CD

  • Release workflow: automated Linux/macOS/Windows builds on version tags
  • rustfmt --check and cargo-audit security scanning in CI

Code Quality

  • 110 unit tests (up from 38 in v5.0.0)
  • Build fix for paths containing CJK/bracket characters
  • Fixed log_clean()/log_outcome() signature mismatch across 59 modules
  • TOML profile mechanism with apply_profile()
  • PayloadRegistry with directory loading and merge support

Full Changelog: v5.0.0...v5.1.0

Full Changelog: https://github.com/Coff0xc/catchclaw/commits/v5.1.0

Assets 5
Loading