OBSIDIAN BLACKSITE 0.21.0 — First official release

OBSIDIAN BLACKSITE — First official release

A Windows desktop application for authorized website and API security assessments. Enter the target URL, run the bounded assessment, inspect the evidence and export Word, HTML, Markdown or JSON. This update connects supplied traffic to active checks and makes tested coverage visible.

Download and setup

1. Download OBSIDIAN_0.21.0_Windows-x64.zip below. Python is included.
2. Check its hash against SHA256SUMS_0.21.0.txt (Get-FileHash .\OBSIDIAN_0.21.0_Windows-x64.zip -Algorithm SHA256 in PowerShell).
3. Extract the entire ZIP into a writable folder. Open OBSIDIAN.exe and keep _internal beside it.
4. Enter an owned/authorized website URL, select Scan Website and review the authorization dialog.
5. Use Assessment setup for synthetic test-account comparisons, OpenAPI imports, HAR route discovery or an explicitly approved small read-only resilience sample. Results export below the scan table; saved assessments are available in Reports and Evidence workspace.

For source installation: Python 3.11, python -m venv .venv, activate it, python -m pip install -r tools/requirements/runtime.txt, then python -m src. Matching source is OBSIDIAN_0.21.0_Source.zip; tests use python -m pytest tools/tests -q after installing tools/requirements/dev.txt.

What changed

• Offline HAR import preserves scoped route/method/query/context metadata while discarding captured credentials, values and bodies. Synthetic GET probes require separate approval; captured authenticated/state-changing traffic is not replayed. Overlap with live crawl routes no longer creates duplicate probes.
• Controlled redirect verification compares a baseline, relative control and two independent destinations. No external redirect destination is contacted. Access checks revalidate the primary account before reporting unexpected protected content.
• Real route/input coverage, bounded SQL-error hypotheses, stable finding keys, saved discovery graph, evidence timeline and confidence inspector.
• Opt-in serial resilience sampling: maximum 20 requests, 2 requests/second and 30 seconds of new-request admission, with cancellation, backpressure/error/latency/client-memory stops. This is not capacity or denial-of-service testing.
• Word coverage/resilience tables, graphite/amethyst UI and public creator links in the application footer.

Actual verification

318 tests passed locally and in GitHub Windows CI. A real Scan-button/QThread test verifies network requests, one controlled redirect proof, benign controls, matching persisted/UI/JSON/Word findings and resilience reporting. The final frozen EXE sent 33 loopback HTTP requests; the server and recorded counts matched. DOCX structure and content were reopened successfully. The three-case supplied-HAR error-disclosure corpus had TP 1, TN 2, FP 0, FN 0; these figures do not measure general detection accuracy or prove SQL injection.

Implementation audit and gaps · Verification record · Full user guide · Current CI

Known limits

Unsigned Windows x64 portable build. No claim of complete penetration-test coverage or commercial-scanner parity. Generic state-changing exploit/cleanup workflows, complete authenticated crawling, stored/blind XSS, SSRF callback execution, uploads, mass assignment, workflow/race testing, verified exploit chains and saved-test replay are incomplete or missing and recorded as gaps. External ZAP/Nmap and fresh browser execution were not demonstrated by this release's local QA. Word page layout remains visually unverified because the renderer is unavailable. No native macOS/Linux package is included in this release.

Use only within explicit target authorization and the agreed test window. Zero findings is not proof of security.

Created by III85III · Telegram @parsamzmz. GPL-3.0-only; matching source and license notices are included.