Skip to content

Release v0.4.4

Latest

Choose a tag to compare

@c1phy c1phy released this 06 May 10:51
· 2 commits to main since this release

✨ New Features

🔧 Enhanced User-Agent Payload Testing

  • Added -add-ua flag to send payloads via the User-Agent header.
  • Works with both GET and POST methods.
  • Delta timing logic and replay integration fully supported.
  • In POST mode, the first available URL parameter is reused as POST body key – fallback to id if none is found (UA-Mode).

🌟 POST Support Improvements

  • Full replay support for POST requests, including:
    • Preserved request bodies
    • Header application
    • Encoding compatibility

📥 Input Validation Improvements

✅ URL Input

  • Invalid or malformed URLs from standard input are now gracefully skipped.
  • Debug output indicates skipped URLs and reasons.

✅ Payload File

  • Input lines now validated and filtered:
    • Empty lines, comments (#), and lines missing {SLEEP} are ignored.
    • Debug logs provide context and line numbers for all ignored lines.

📒 Enhanced Payload Handling

  • Payloads containing spaces are auto-encoded unless -encode is set.
  • Debug output indicates encoding decisions with before/after values.

🧠 Smarter Output Formatting

  • Shared logic for User-Agent and param-based payload reporting (reportFinding) has been simplified and unified.
  • Final report includes clearer delta presentation and detection context.

🔢 Debugging Enhancements

  • Detailed messages added for:
    • Proxy and replay proxy connectivity checks
    • Request delays (-delay)
    • Payload injections and response timing
    • Payload auto-encoding logic
  • Notify debug output now shows truncated messages with coloring.

🔧 Internal Refactors and Fixes

  • Introduced recordedRequest struct to support full request replays.
  • Abstracted replay logic into a clean doReplayFromRequest() helper.
  • Merged duplicated logic between GET and POST flows.
  • Added getMethod() utility to avoid manual "GET"/"POST" duplication.
  • Final output summary now uses consistent formatting logic.
  • Color and prefix constants centralized and fully honored in no-color mode.
  • Increased resilience in error handling (nil checks, fallbacks).
  • Clean and thread-safe seen map access across goroutines.

🧪 Usage Tips

  • Use -debug to trace internal behavior.
  • Set -spm to exit early per target on first confirmed delay match.