Skip to content

v1.4.2

Choose a tag to compare

@intrudir intrudir released this 28 Aug 20:04
· 13 commits to main since this release
  • Standalone CLI supporting sweep, bypass, idor, and url-validation.
  • High Signal and All Payloads modes with selectable payload families.
  • CLI inputs for URL lists, raw requests, request manifests, OpenAPI/Swagger, Postman collections, and Burp retry packages.
  • CLI distributions as a fat JAR, installable ZIP, and non-root Docker image.
  • HTTP/1.0, HTTP/1.1, HTTP/2, h2c, and ALPN support in the CLI.
  • Streaming JSONL results with raw request/response evidence, optional redaction, and strict YAML job files.
  • Separate network destination and fuzzable Host header handling.
  • Postman Collection v2.0/v2.1 imports in Burp Sweep, preserving methods, headers, authentication, parameters, and bodies.
  • Sweep selection between the bounded High Signal corpus and the complete selected Bypass payload catalog.
  • Expanded High Signal coverage, including backslash mutations across every path segment and a 350-probe default cap.
  • Shared execution controls across all Burp modes: hard global/per-host concurrency limits, fixed or smart pauses, throttle codes, headers, and User-Agent randomization.
  • Shared deferred Retry Queue across Bypass, Sweep, IDOR, and URL Validation.
  • Automatic retry handling for throttled and no-response requests, with every attempt retained and labeled in the results table.
  • Safe Sweep GET/HEAD fallback retries over HTTP/1 when automatic protocol negotiation returns no response.
  • Large-scan resource controls: lazy request generation, bounded worker/UI queues, batched Swing updates, and temp-file-backed evidence.
  • Accurate progress telemetry separating planned payloads, HTTP requests sent, results recorded, filtered rows shown, and deferred retries.
  • Manual response filter option for “does not contain,” including regex inversion.
  • Corrected trailing-slash handling for extension and Sweep suffix mutations.
  • Burp and CLI verification harnesses covering UI routing, live engines, local HTTP behavior, and evidence output.
  • Burp Collaborator payloads remain intentionally excluded from the CLI.