v1.4.4

Fix bypass mode transport errors causing requests to fail

v1.4.3

Beefed up the IDOR scanner:

• added some more IDOR payload test cases
• specification of where you'd like to inject identifiers
• added IDOR playbook controls

Upgraded "Preview Probes" functionality across all the scanners

v1.4.2

• Standalone CLI supporting sweep, bypass, idor, and url-validation.
• High Signal and All Payloads modes with selectable payload families.
• CLI inputs for URL lists, raw requests, request manifests, OpenAPI/Swagger, Postman collections, and Burp retry packages.
• CLI distributions as a fat JAR, installable ZIP, and non-root Docker image.
• HTTP/1.0, HTTP/1.1, HTTP/2, h2c, and ALPN support in the CLI.
• Streaming JSONL results with raw request/response evidence, optional redaction, and strict YAML job files.
• Separate network destination and fuzzable Host header handling.
• Postman Collection v2.0/v2.1 imports in Burp Sweep, preserving methods, headers, authentication, parameters, and bodies.
• Sweep selection between the bounded High Signal corpus and the complete selected Bypass payload catalog.
• Expanded High Signal coverage, including backslash mutations across every path segment and a 350-probe default cap.
• Shared execution controls across all Burp modes: hard global/per-host concurrency limits, fixed or smart pauses, throttle codes, headers, and User-Agent randomization.
• Shared deferred Retry Queue across Bypass, Sweep, IDOR, and URL Validation.
• Automatic retry handling for throttled and no-response requests, with every attempt retained and labeled in the results table.
• Safe Sweep GET/HEAD fallback retries over HTTP/1 when automatic protocol negotiation returns no response.
• Large-scan resource controls: lazy request generation, bounded worker/UI queues, batched Swing updates, and temp-file-backed evidence.
• Accurate progress telemetry separating planned payloads, HTTP requests sent, results recorded, filtered rows shown, and deferred retries.
• Manual response filter option for “does not contain,” including regex inversion.
• Corrected trailing-slash handling for extension and Sweep suffix mutations.
• Burp and CLI verification harnesses covering UI routing, live engines, local HTTP behavior, and evidence output.
• Burp Collaborator payloads remain intentionally excluded from the CLI.

v1.4.1

• New Global dashboard. Manage all runnings scans and pause/resume/stop all from there.
• Added global rate limit. So if you're scanning several individual requests in bypass mode for example, you can say "cap all in flight requests to 10" or do no more than 10 reqs/second across all my scans

v1.4

Major features and upgrades since v1.3.1.

Coverage Sweep overhaul

• Added High Signal and All Payloads sweep modes.

• Added payload-family selection, allowing individual families such as header attacks to be disabled.

• Added the complete Bypass attack catalog to All Payloads sweeps.

• Added local and remote OpenAPI import support.

• Added OpenAPI base URL overrides, HTTP/1.1 and HTTP/2 selection, parameter processing, malformed-
  path preservation, and optional endpoint deduplication.

• Added retry-queue JSON import as regular Sweep candidates.

• Added sortable candidates, host exclusion, completed-host tracking, and improved import/export
  controls.

• Replaced estimated progress with exact generated-request progress and separate main-sweep/retry
  phases.

• Restricted authentication request/response tabs to Authenticated Traffic mode.

Adaptive throttling

• Replaced the old global rate limiter with adaptive per-host rate controllers.

• Added Ride Hard and Conservative throttle postures.

• Added four pause strategies:

  • No global pause
  • Adaptive pause
  • Fixed pause
  • Smart pause

• Smart Pause now tolerates isolated 429s and only trips on meaningful rolling or consecutive
  throttle patterns.

• Added escalating cooldowns and controlled recovery probes.

• Fixed oscillating recovery rates and throttle-floor behavior.

• Fixed queued requests continuing after Pause.

• Prevented accumulated rate credit and request bursts after Resume.

• Longer manual pauses now cold-start the adaptive rate safely.

Retry Queue improvements

• Added automatic deferred handling for 429 and 503 responses.

• Added manual Retry Queue inspection, JSON export, and payload-wordlist export.

• Added Pause, Resume, and Stop Retry controls.

• Stopping a retry pass preserves all unfinished requests.

• Added control-canary classification before replaying Sweep retries.

• Stable WAF responses are now distinguished from transient rate limits.

• Payloads that consistently produce 403 control → 429 mutation are quarantined as stable pattern
  blocks instead of being replayed hundreds of times.

• Retry Queue counts now distinguish retryable requests from stable pattern-blocked responses.

Pause and resume across scan modes

• Added cooperative Pause/Resume controls to:

  • Regular Bypass scans
  • Coverage Sweeps
  • IDOR scans
  • URL Validation scans
  • Retry Queue passes

• Pausing finishes already-sent requests, blocks new sends, and resumes from the current position.

New and expanded attacks

• Added double-port Host-header bypass probes.
• Enabled double-port Host attacks by default.
• Integrated double-port probes into the Host Parsing payload family.
• Enabled Collaborator header payloads by default when Collaborator is available.
• Expanded path-normalization coverage with:
  • Standalone semicolon segments
  • Matrix-parameter boundaries
  • Parent-directory segments
  • Encoded path markers
  • Per-segment marker placement

Request customization

• Added configurable always-send request headers across scan modes.

• Added a browser User-Agent preset.

• Preserved configured headers consistently across controls, mutations, authentication stripping,
  retries, and OpenAPI imports.

• Added explicit authentication-header and cookie selection for Authenticated Traffic sweeps.

Interface improvements

• Consolidated Sweep imports and exports into dedicated menus.
• Moved Retry Throttled into the Retry Queue menu.
• Moved general Bypass options into an Options… menu while keeping attack-family toggles visible.
• Added Configure Attack to IDOR mode.
• Moved Browser Agent beside the state-changing-request option.
• Added mode-specific loading controls and Clear Import behavior.
• Improved progress, retry, throttle, pause, and completion status messages.

Reliability and compatibility

• Fixed authenticated Proxy history collection.
• Fixed HTTP/2 scope evaluation for blocked and authenticated traffic.
• Fixed large imports and cross-platform Sweep scheduling.
• Improved malformed OpenAPI URL handling.
• Added bounded live-fire throttle and pause/resume test harnesses.
• Expanded automated coverage for adaptive throttling, imports, payload generation, retry
  classification, pausing, request headers, and Sweep execution.

v1.3

Add authenticated traffic sweep mode

v1.2

• Export to CSV.
• Import text file with endpoints like
  https://victim.com/admin/users
  https://victim.com/admin/foo
  etc...
• Support concurrent requests in sweep & bypass tabs.
• bumped from 25 -> 120 test cases in the sweep tab

v1.1

Update checker posts a banner instead of a pop up

Bumped sweep coverage to 50 highest signal payloads

v1.0.9

Release notes:

• Added new Sweep tab available immediately on extension startup.
• Added broad in-scope Proxy history loading for selected response classes, defaulting to 401 and 403.
• Added candidate deduplication for Sweep endpoints to reduce repeated testing noise.
• Added bounded Sweep execution with a default cap of 30 probes per endpoint.
• Added explicit build-time Sweep probe wordlist at payloads/sweep_probes.txt.
• Added Sweep probe preview so users can inspect exact requests before sending.
• Added path normalization probes for matrix suffixes, slash variants, case variants, URL encoding, and debug params.
• Added concrete Sweep signals such as 403 -> 200 instead of generic bypass labels.
• Suppressed noisy Sweep signals for 4xx probe responses.
• Improved Welcome tab layout and clarified targeted testing versus Sweep workflow.
• Fixed URL Validation dialog initialization for headless/test environments.