v1.3.0

What's New in v1.3.0

New Features

• Input List Support (-u): Pass a file containing multiple URLs (one per line) to scan them all in a single run. The -u flag now auto-detects whether the argument is a URL or a file path. (#37)
• Output to File (-o): Save scan results directly to a file for later analysis.
• JSON Output (--json): Output all results in structured JSON format, ideal for piping into other tools or automation pipelines. (#37)
• Unicode Encoding Technique: New unicode bypass technique that generates overlong UTF-8 (%c1%a1), %uXXXX, and multi-byte overlong encoded path variations to evade WAFs and path filters. (#47)
• Custom Payload Positions (-p): Define injection points in the URL using custom markers (e.g., -p '§' -u 'http://target.com/§100§/admin'). Payloads from endpaths and midpaths are injected at each marked position. (#34)

Bug Fixes

• HTTP/2.0 Request File Parsing: Fixed a bug where HTTP/2.0 in Burp Suite request files was incorrectly converted to HTTP/1.1.0 instead of HTTP/1.1.
• Query String Preservation: Fixed query strings being silently dropped in double-encoding, midpaths, and path-case-switching techniques.
• Double-Encoding Byte Index: Fixed incorrect byte slicing for multi-byte runes in the double-encoding technique.
• Overlong UTF-8 Formula: Fixed the 2-byte overlong encoding formula that was producing incorrect byte sequences (e.g., %c0%e1 instead of %c1%a1 for 'a').

Improvements

• Added 4 new bypass-relevant endpaths: ?&, .., /., ;/
• Unicode encoding is now included in the default technique list
• Wider main banners (NOMORE403, AUTO-CALIBRATION) for better visual hierarchy
• Thread-safe JSON result accumulation
• Comprehensive test coverage for all new features and bug fixes (29 tests passing)

Closes

• #37 - Input List/Output
• #47 - Enhancement techniques (Unicode encoding)
• #34 - Custom payload positions