Skip to content

v1.4

Choose a tag to compare

View all tags
@intrudir intrudir released this 20 Aug 19:32
· 35 commits to main since this release
v1.4
a1339d9

Major features and upgrades since v1.3.1.

Coverage Sweep overhaul

  • Added High Signal and All Payloads sweep modes.

  • Added payload-family selection, allowing individual families such as header attacks to be disabled.

  • Added the complete Bypass attack catalog to All Payloads sweeps.

  • Added local and remote OpenAPI import support.

  • Added OpenAPI base URL overrides, HTTP/1.1 and HTTP/2 selection, parameter processing, malformed-
    path preservation, and optional endpoint deduplication.

  • Added retry-queue JSON import as regular Sweep candidates.

  • Added sortable candidates, host exclusion, completed-host tracking, and improved import/export
    controls.

  • Replaced estimated progress with exact generated-request progress and separate main-sweep/retry
    phases.

  • Restricted authentication request/response tabs to Authenticated Traffic mode.

Adaptive throttling

  • Replaced the old global rate limiter with adaptive per-host rate controllers.

  • Added Ride Hard and Conservative throttle postures.

  • Added four pause strategies:

    • No global pause
    • Adaptive pause
    • Fixed pause
    • Smart pause

  • Smart Pause now tolerates isolated 429s and only trips on meaningful rolling or consecutive
    throttle patterns.

  • Added escalating cooldowns and controlled recovery probes.

  • Fixed oscillating recovery rates and throttle-floor behavior.

  • Fixed queued requests continuing after Pause.

  • Prevented accumulated rate credit and request bursts after Resume.

  • Longer manual pauses now cold-start the adaptive rate safely.

Retry Queue improvements

  • Added automatic deferred handling for 429 and 503 responses.

  • Added manual Retry Queue inspection, JSON export, and payload-wordlist export.

  • Added Pause, Resume, and Stop Retry controls.

  • Stopping a retry pass preserves all unfinished requests.

  • Added control-canary classification before replaying Sweep retries.

  • Stable WAF responses are now distinguished from transient rate limits.

  • Payloads that consistently produce 403 control → 429 mutation are quarantined as stable pattern
    blocks instead of being replayed hundreds of times.

  • Retry Queue counts now distinguish retryable requests from stable pattern-blocked responses.

Pause and resume across scan modes

  • Added cooperative Pause/Resume controls to:

    • Regular Bypass scans
    • Coverage Sweeps
    • IDOR scans
    • URL Validation scans
    • Retry Queue passes

  • Pausing finishes already-sent requests, blocks new sends, and resumes from the current position.

New and expanded attacks

  • Added double-port Host-header bypass probes.
  • Enabled double-port Host attacks by default.
  • Integrated double-port probes into the Host Parsing payload family.
  • Enabled Collaborator header payloads by default when Collaborator is available.
  • Expanded path-normalization coverage with:
    • Standalone semicolon segments
    • Matrix-parameter boundaries
    • Parent-directory segments
    • Encoded path markers
    • Per-segment marker placement

Request customization

  • Added configurable always-send request headers across scan modes.

  • Added a browser User-Agent preset.

  • Preserved configured headers consistently across controls, mutations, authentication stripping,
    retries, and OpenAPI imports.

  • Added explicit authentication-header and cookie selection for Authenticated Traffic sweeps.

Interface improvements

  • Consolidated Sweep imports and exports into dedicated menus.
  • Moved Retry Throttled into the Retry Queue menu.
  • Moved general Bypass options into an Options… menu while keeping attack-family toggles visible.
  • Added Configure Attack to IDOR mode.
  • Moved Browser Agent beside the state-changing-request option.
  • Added mode-specific loading controls and Clear Import behavior.
  • Improved progress, retry, throttle, pause, and completion status messages.

Reliability and compatibility

  • Fixed authenticated Proxy history collection.
  • Fixed HTTP/2 scope evaluation for blocked and authenticated traffic.
  • Fixed large imports and cross-platform Sweep scheduling.
  • Improved malformed OpenAPI URL handling.
  • Added bounded live-fire throttle and pause/resume test harnesses.
  • Expanded automated coverage for adaptive throttling, imports, payload generation, retry
    classification, pausing, request headers, and Sweep execution.
Assets 3
Loading