OBSIDIAN BLACKSITE 0.21.0 — First official release

OBSIDIAN BLACKSITE — First official release

A Windows desktop application for authorized website and API security assessments. Enter the target URL, run the bounded assessment, inspect the evidence and export Word, HTML, Markdown or JSON. This update connects supplied traffic to active checks and makes tested coverage visible.

Download and setup

1. Download OBSIDIAN_0.21.0_Windows-x64.zip below. Python is included.
2. Check its hash against SHA256SUMS_0.21.0.txt (Get-FileHash .\OBSIDIAN_0.21.0_Windows-x64.zip -Algorithm SHA256 in PowerShell).
3. Extract the entire ZIP into a writable folder. Open OBSIDIAN.exe and keep _internal beside it.
4. Enter an owned/authorized website URL, select Scan Website and review the authorization dialog.
5. Use Assessment setup for synthetic test-account comparisons, OpenAPI imports, HAR route discovery or an explicitly approved small read-only resilience sample. Results export below the scan table; saved assessments are available in Reports and Evidence workspace.

For source installation: Python 3.11, python -m venv .venv, activate it, python -m pip install -r tools/requirements/runtime.txt, then python -m src. Matching source is OBSIDIAN_0.21.0_Source.zip; tests use python -m pytest tools/tests -q after installing tools/requirements/dev.txt.

What changed

• Offline HAR import preserves scoped route/method/query/context metadata while discarding captured credentials, values and bodies. Synthetic GET probes require separate approval; captured authenticated/state-changing traffic is not replayed. Overlap with live crawl routes no longer creates duplicate probes.
• Controlled redirect verification compares a baseline, relative control and two independent destinations. No external redirect destination is contacted. Access checks revalidate the primary account before reporting unexpected protected content.
• Real route/input coverage, bounded SQL-error hypotheses, stable finding keys, saved discovery graph, evidence timeline and confidence inspector.
• Opt-in serial resilience sampling: maximum 20 requests, 2 requests/second and 30 seconds of new-request admission, with cancellation, backpressure/error/latency/client-memory stops. This is not capacity or denial-of-service testing.
• Word coverage/resilience tables, graphite/amethyst UI and public creator links in the application footer.

Actual verification

318 tests passed locally and in GitHub Windows CI. A real Scan-button/QThread test verifies network requests, one controlled redirect proof, benign controls, matching persisted/UI/JSON/Word findings and resilience reporting. The final frozen EXE sent 33 loopback HTTP requests; the server and recorded counts matched. DOCX structure and content were reopened successfully. The three-case supplied-HAR error-disclosure corpus had TP 1, TN 2, FP 0, FN 0; these figures do not measure general detection accuracy or prove SQL injection.

Implementation audit and gaps · Verification record · Full user guide · Current CI

Known limits

Unsigned Windows x64 portable build. No claim of complete penetration-test coverage or commercial-scanner parity. Generic state-changing exploit/cleanup workflows, complete authenticated crawling, stored/blind XSS, SSRF callback execution, uploads, mass assignment, workflow/race testing, verified exploit chains and saved-test replay are incomplete or missing and recorded as gaps. External ZAP/Nmap and fresh browser execution were not demonstrated by this release's local QA. Word page layout remains visually unverified because the renderer is unavailable. No native macOS/Linux package is included in this release.

Use only within explicit target authorization and the agreed test window. Zero findings is not proof of security.

Created by III85III · Telegram @parsamzmz. GPL-3.0-only; matching source and license notices are included.

OBSIDIAN 0.20.0 — Controlled verification and coverage

Install on Windows

1. Download OBSIDIAN_0.20.0_Windows-x64.zip below. GitHub's automatic Source code archive is not the runnable app.
2. Extract the entire ZIP into a writable folder.
3. Open OBSIDIAN.exe. Keep _internal beside it. Python is not required.
4. Read the notice, enter your authorized website URL and select Scan Website.
5. Review the evidence and use Export Word report, HTML, Markdown or JSON. Right-click Scan for optional synthetic-account/OpenAPI setup.

This is an unsigned release candidate, not a claim of complete penetration-test coverage. Browser verification requires a supported signed Edge/Chrome installation. Optional ZAP/Nmap are separate installations; availability and coverage are recorded honestly.

For source installation, download OBSIDIAN_0.20.0_Source.zip, use Python 3.11, then run:

python -m venv .venv
.\.venv\Scripts\Activate.ps1
python -m pip install -r requirements.txt
python main.py

Compare the Windows/source ZIP hashes with SHA256SUMS_0.20.0.txt. VERIFICATION_0.20.0.json records actual local tests and limitations. User guide · Implementation and rename audit.

GitHub Windows CI also passed: verified source revision.

---

OBSIDIAN 0.20.0

The existing desktop application now uses OBSIDIAN branding. This is an unsigned Windows release candidate, with the existing architecture and integrations retained.

• New frozen installations use %LOCALAPPDATA%\III85III\OBSIDIAN. Existing portable or per-user Qolam Sentinel databases are used in place. No history, settings or credentials are copied, reset or renamed.
• SQL error checks now compare the original request, an alphanumeric control and two quote requests. Only new repeated database signatures become potential error-disclosure findings. SQL injection or extraction is not inferred.
• Automatic system-file probes and their unsupported Critical classification are replaced by explicitly provisioned synthetic file canaries with two controls and repeated observations. The assessor must declare the boundary. This capability is an engine option; there is no file-canary setup screen.
• GET form discovery preserves parameter case and supplied defaults, omitting passwords, tokens, disabled and unchecked controls.
• Verification coverage, redacted native request provenance, cancellation and stopping after target 429/503 responses are integrated into the existing scanner. Native operations stop before the next request; already-running optional engines finish their bounded operation before the next engine is cancelled.
• Word includes coverage states, evidence prerequisites, numbered reproduction guidance when recorded, and a clear statement when no finding is validated. Exact duplicates are consolidated across exports. HTML and Markdown include readable coverage too.

No heavy dependencies or new external scanner engines were installed. ZAP is unavailable on the verification machine; its existing optional adapter is retained. Tool imports remain source-reported, not independently validated.

The complete source regression suite passed 289 tests. Local labeled SQL/file corpus: 9 cases, 2 true positives, 7 true negatives, 0 false positives and 0 false negatives. These are narrow synthetic error-disclosure/file-canary cases, not general SQL injection or website accuracy measurements.

Actual frozen-runtime and report results are recorded in docs/verification/VERIFICATION_0.20.0.json. DOCX generation/reopening and factual checks were exercised. Visual DOCX rendering is unverified because LibreOffice is not installed; the renderer reported soffice.exe was not found on PATH.

Stored/blind XSS, command injection, SSRF callbacks, full authentication lifecycle, property-level API authorization, mass assignment and business workflows remain incomplete or require declared synthetic scenarios. No complete-production-readiness or universal coverage claim is made.

Qolam_Hacker 0.19.1 - Web Penetration Testing for Windows

Qolam_Hacker 0.19.1 — Web Penetration Testing

One primary Scan Website action, improved JavaScript/API mapping, stronger session controls and clearer verification evidence. The Windows app is ready to download below.

Install

Download Qolam_Hacker_0.19.1_Windows-x64.zip, extract the complete ZIP and open Qolam_Hacker.exe. Keep _internal beside it. Python is not required. The app and download filenames use the same Qolam_Hacker name.

Browser confirmation requires a normally installed, signed Edge or Chrome. Optional ZAP/Nmap are separate installations. Complete setup and user guide.

Changes

• One-button automatic assessment; optional session/API setup is available by right-clicking Scan.
• Bounded same-origin application relationships with script/route/source-map provenance.
• Structured source-map validation and redacted credential-shaped findings.
• Comment/string-aware static flow candidates with reassignment and scope controls.
• Two-origin CORS controls and two independent benign arithmetic challenges.
• Anonymous session-canary controls, repeated access observations and secondary-account revalidation.
• No automatic adjacent-object ID guesses, server-loopback SSRF probes or method-override POSTs.
• Visible API-discovery attempts, consistent native request counts, and storage/export redaction.
• Existing Word, HTML, Markdown and JSON report integrations retained.

Verification

270 source tests passed. The packaged EXE recorded 31 website requests matching 31 server-observed requests on a disposable loopback target. Packaged checks verified application mapping, source maps, token redaction, repeatable arithmetic evidence, database persistence, JSON export and actual Word generation/reopening.

The 13-case lexical JavaScript subset had TP 4, TN 9, FP 0 and FN 0. This is a small labeled corpus, not a general detection benchmark. See the coverage audit.

Download checks and status

Compare your ZIP's SHA-256 with SHA256SUMS_0.19.1.txt. Matching application source is included in the package and offered separately. VERIFICATION_0.19.1.json contains the runtime verification summary.

Unsigned Windows release candidate. Native macOS/Linux packages, completed visual Word layout review, independent audit and exhaustive vulnerability coverage are not claimed. Use only within written authorization.

ATTACK WEBSITE TOOLS 0.19.0 - Web Penetration Testing

ATTACK WEBSITE TOOLS - Web Penetration Testing 0.19.0 - Windows release candidate

A Windows desktop workbench for authorized web assessment, with browser-confirmed reflected XSS, OpenAPI discovery, explicit session/access checks and Word/JSON reporting.

Download and run

Download the Windows-x64 ZIP, extract the whole folder and run Qolam_Sentinel.exe. Keep _internal beside it. Python is not needed. Edge or Chrome is required for browser confirmation; ZAP and Nmap are optional separate tools.

Verified behavior

• 227 local Windows source tests passed.
• Five packaged API cases verified persistence, JSON export and real DOCX generation/reopening.
• Three browser cases distinguished executing XSS from encoded and CSP-blocked input.
• Four supplied-session cases checked access expectations and incomplete coverage.
• Matching application source, collected licenses and per-file hashes are included.

Release status

Unsigned pre-release. Visual Word layout review, clean-machine compatibility and an independent audit are not claimed. Automated coverage is bounded; zero findings is not a security certification.

Use only on targets you own or are explicitly authorized to assess.

The repository has been renamed to ATTACK WEBSITE TOOLS. Version 0.19.0 keeps its original Sentinel executable and archive filenames so the verified build and checksums remain unchanged.

Complete installation and user guide.