Skip to content

v0.2.8

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Oct 12:24
· 3 commits to main since this release
v0.2.8
44e3d71

Highlights

  • Preserve successful module coverage when individual payload attempts fail or are blocked instead of incorrectly collapsing the target into PARTIAL.
  • Use observed parser behavior to generate WAF-aware payloads while keeping SQL boolean and timing controls semantically matched.
  • Confirm non-reflected DOM XSS directly in a browser with clean controls and multiple CSP-tolerant execution canaries.
  • Reduce false-positive SSRF findings by rejecting payload reflection and requiring provider-specific metadata evidence.

Traffic safety and performance

  • Honor 429, Retry-After and WAF challenge responses with a host-level wait-and-recovery circuit.
  • Keep deliberate rate-limit verification 429 responses as evidence without parking unrelated modules behind the global WAF circuit.
  • Pace backup archive enumeration per origin, prioritize high-yield paths and stop after pressure signals or a verified exposure.
  • Reuse captured bodies across passive Sensitive Data, Secret Exposure, Script Source, Vulnerable Components and Known CVE analysis.
  • Limit browser crawling to pages where JavaScript execution can add coverage, apply one shared hidden-parameter concurrency gate and batch only safe candidate prefilters.
  • Exclude robots.txt, sitemap and .well-known discovery documents from active hidden-parameter probing.

Accuracy and scan control

  • Apply compound WAF encodings through one transformation path with exact URL-depth, UTF-8 and SQL keyword preservation.
  • Generate encoded SQL time-delay/zero-control and boolean true/false pairs atomically.
  • Continue discovery through nonstandard gateway statuses such as HTTP 556.
  • Keep directory fuzzing and 403-bypass phases out of narrow --mode scans unless explicitly selected.
  • Distinguish true browser-only DOM execution from browser-confirmed reflected XSS and reject pre-existing execution markers.

Install with Go

The engine/v0.2.8 module tag makes both commands install this release:

go install github.com/akha-security/akca/engine/cmd/akca@v0.2.8
go install github.com/akha-security/akca/engine/cmd/akca@latest

Downloads

  • akca-windows-amd64.exe - Windows x64
  • akca-linux-amd64 - Linux x64
  • akca-linux-arm64 - Linux ARM64
  • akca-darwin-amd64 - macOS Intel
  • akca-darwin-arm64 - macOS Apple Silicon
  • SHA256SUMS.txt - SHA-256 verification manifest

Release binaries include GitHub build-provenance attestations and can be verified with gh attestation verify <binary> -R akha-security/akca.

Browser-backed checks require Chrome, Chromium, or Edge. Use AKCA only against systems you own or are explicitly authorized to test.

Full changelog: v0.2.7...v0.2.8

Assets 8
Loading