Anubis v2.5.2 — Crawler, Custom Templates, Smarter Detection & New Modules

Anubis v2.5.2

The biggest update since v2.0 — new scan modules, a built-in web crawler, a Nuclei-style YAML template engine, dramatically improved SQLi/XSS detection, and a much faster subdomain discovery pipeline.

✨ New Features

🔍 Crawler (--crawl)

New dependency-free crawler discovers endpoints before injection testing:

• Same-host link extraction with query strings

• GET form parsing — input names become testable parameters

• Depth and page limits: --crawl-depth, --crawl-max-pages

• Inherits rate limiting, SSL bypass, and proxy settings from your scan

anubis -t https://example.com -l 2 --crawl --crawl-depth 2 --crawl-max-pages 50

🧩 Custom YAML Templates (--templates)

Define your own checks without touching Go code — Nuclei-style matchers:

id: admin-panel-detect
name: "Admin Panel Detection"
severity: low
level: 1
endpoint: /admin
matchers:
  - type: status
    value: "200"
  - type: contains
    value: "admin"

anubis --templates ./templates/custom -t https://example.com -l 2

Supported matcher types: contains, regex, status, header, words — combine with condition: and|or, inline or file-based payloads, custom placeholder, CVSS/OWASP mapping and remediation text.

🆕 Three New Scan Modules

Module | Level | What it detects -- | -- | -- LFI | L2 | Path traversal with classic, filter-evasion and double-encoding payloads (..%252f, ....//) — content-signature confirmed SSTI | L2 | Server-side template injection using the marker technique ({{7*7}} → evaluated 49 between unique markers) — raw echoes never raise findings OPENREDIRECT | L2 | Canary-host redirect detection via Location header, meta-refresh and JS redirects — no external network calls, uses reserved .invalid TLD

🧠 Rewritten Detection Engine

• SQL Injection: three techniques in one pass

  • Error-based with baseline comparison — DB error signatures only fire when absent from the baseline response (dramatically fewer false positives)

  • Boolean-based blind — AND 1=1 vs AND 1=2 differential vs baseline

  • Time-based blind — MySQL/PostgreSQL/MSSQL sleep payloads with two-request verification (auto-disabled in --ghost)

• Reflected XSS — reflection is confirmed only when the raw marker appears unescaped; URL-encoded echoes are correctly rejected

📁 External Wordlists

--wordlist now feeds sensitive-file discovery too, not just brute-force:

anubis -t https://example.com -l 1 --wordlist ~/seclists/Discovery/Web-Content/common.txt

Unknown paths get severity LOW so your triage queue stays clean.

🌐 Certificate Transparency Subdomain Discovery

With --external-api, DNS enumeration now queries crt.sh Certificate Transparency logs and merges results with brute-force subdomain discovery:

anubis -t example.com -l 2 --external-api

🐞 Reliability Fixes

• Crash logs now written to the user cache dir (~/.cache/anubis/crash.log) instead of the source tree — no more repo pollution, no more failures on read-only paths

• Build artifacts and crash logs removed from the repository; proper .gitignore added

📦 Packaging

• Homebrew: brew tap SepJs/anubis && brew install anubis

• PowerShell (Windows): iex ((New-Object System.Net.WebClient).DownloadString('https://raw.githubusercontent.com/SepJs/anubis/main/install.ps1'))

• Docker, static binaries for Linux / Windows / macOS — still zero CGO

📚 Documentation

Full docs: github.com/SepJs/anubis — YAML template format, examples in templates/custom/, and the complete flag reference.

# Anubis v2.5.2

The biggest update since v2.0 — new scan modules, a built-in web crawler, a Nuclei-style YAML template engine, dramatically improved SQLi/XSS detection, and a much faster subdomain discovery pipeline.

✨ New Features

🔍 Crawler (--crawl)

New dependency-free crawler discovers endpoints before injection testing:

• Same-host link extraction with query strings
• GET form parsing — input names become testable parameters
• Depth and page limits: --crawl-depth, --crawl-max-pages
• Inherits rate limiting, SSL bypass, and proxy settings from your scan

anubis -t https://example.com -l 2 --crawl --crawl-depth 2 --crawl-max-pages 50

🧩 Custom YAML Templates (--templates)

Define your own checks without touching Go code — Nuclei-style matchers:

id: admin-panel-detect
name: "Admin Panel Detection"
severity: low
level: 1
endpoint: /admin
matchers:
  - type: status
    value: "200"
  - type: contains
    value: "admin"

anubis --templates ./templates/custom -t https://example.com -l 2

Supported matcher types: contains, regex, status, header, words — combine with condition: and|or, inline or file-based payloads, custom placeholder, CVSS/OWASP mapping and remediation text.

🆕 Three New Scan Modules

Module	Level	What it detects
LFI	L2	Path traversal with classic, filter-evasion and double-encoding payloads (..%252f, ....//) — content-signature confirmed
SSTI	L2	Server-side template injection using the marker technique ({{7*7}} → evaluated 49 between unique markers) — raw echoes never raise findings
OPENREDIRECT	L2	Canary-host redirect detection via Location header, meta-refresh and JS redirects — no external network calls, uses reserved .invalid TLD

🧠 Rewritten Detection Engine

• SQL Injection: three techniques in one pass

  • Error-based with baseline comparison — DB error signatures only fire when absent from the baseline response (dramatically fewer false positives)
  • Boolean-based blind — AND 1=1 vs AND 1=2 differential vs baseline
  • Time-based blind — MySQL/PostgreSQL/MSSQL sleep payloads with two-request verification (auto-disabled in --ghost)

• Reflected XSS — reflection is confirmed only when the raw marker appears unescaped; URL-encoded echoes are correctly rejected

📁 External Wordlists

--wordlist now feeds sensitive-file discovery too, not just brute-force:

anubis -t https://example.com -l 1 --wordlist ~/seclists/Discovery/Web-Content/common.txt

Unknown paths get severity LOW so your triage queue stays clean.

🌐 Certificate Transparency Subdomain Discovery

With --external-api, DNS enumeration now queries crt.sh Certificate Transparency logs and merges results with brute-force subdomain discovery:

anubis -t example.com -l 2 --external-api

🐞 Reliability Fixes

• Crash logs now written to the user cache dir (~/.cache/anubis/crash.log) instead of the source tree — no more repo pollution, no more failures on read-only paths
• Build artifacts and crash logs removed from the repository; proper .gitignore added

📦 Packaging

• Homebrew: brew tap SepJs/anubis && brew install anubis
• PowerShell (Windows): iex ((New-Object System.Net.WebClient).DownloadString('https://raw.githubusercontent.com/SepJs/anubis/main/install.ps1'))
• Docker, static binaries for Linux / Windows / macOS — still zero CGO

📚 Documentation

Full docs: [github.com/SepJs/anubis](https://github.com/SepJs/anubis) — YAML template format, examples in templates/custom/, and the complete flag reference.