Releases
v0.4.4
Compare
Sorry, something went wrong.
No results found
c1phy
released this
06 May 10:51
✨ New Features
🔧 Enhanced User-Agent Payload Testing
Added -add-ua flag to send payloads via the User-Agent header.
Works with both GET and POST methods.
Delta timing logic and replay integration fully supported.
In POST mode, the first available URL parameter is reused as POST body key – fallback to id if none is found (UA-Mode).
🌟 POST Support Improvements
Full replay support for POST requests, including:
Preserved request bodies
Header application
Encoding compatibility
📥 Input Validation Improvements
✅ URL Input
Invalid or malformed URLs from standard input are now gracefully skipped.
Debug output indicates skipped URLs and reasons.
✅ Payload File
Input lines now validated and filtered:
Empty lines , comments (#), and lines missing {SLEEP} are ignored.
Debug logs provide context and line numbers for all ignored lines.
📒 Enhanced Payload Handling
Payloads containing spaces are auto-encoded unless -encode is set.
Debug output indicates encoding decisions with before/after values.
🧠 Smarter Output Formatting
Shared logic for User-Agent and param-based payload reporting (reportFinding) has been simplified and unified.
Final report includes clearer delta presentation and detection context.
🔢 Debugging Enhancements
Detailed messages added for:
Proxy and replay proxy connectivity checks
Request delays (-delay)
Payload injections and response timing
Payload auto-encoding logic
Notify debug output now shows truncated messages with coloring.
🔧 Internal Refactors and Fixes
Introduced recordedRequest struct to support full request replays.
Abstracted replay logic into a clean doReplayFromRequest() helper.
Merged duplicated logic between GET and POST flows.
Added getMethod() utility to avoid manual "GET"/"POST" duplication.
Final output summary now uses consistent formatting logic.
Color and prefix constants centralized and fully honored in no-color mode.
Increased resilience in error handling (nil checks, fallbacks).
Clean and thread-safe seen map access across goroutines.
🧪 Usage Tips
Use -debug to trace internal behavior.
Set -spm to exit early per target on first confirmed delay match.
You can’t perform that action at this time.