Sift 2.2.3

• Emulator: if the device already has a newer or differently signed build of the app (apps often update themselves), Sift now replaces it instead of failing with INSTALL_FAILED_VERSION_DOWNGRADE. Install failures show Android's actual failure code.
• Apps whose manifest label is a string resource are now named properly (for example "Epic Games" instead of the APK file name), including in traffic tags.

Tested end to end with Epic Games 1.5.1: analysis in about 10 seconds, every finding opens in the code viewer, the app launched on the Sift device in 24 seconds from a snapshot, and all of its own HTTPS traffic was decrypted, bodies included.

Sift 2.2.2

• Fixed "certificate rejected by the app" on every request from the emulator. Sift saved its CA on the device under the wrong file name (SHA-1 instead of OpenSSL's subject_hash_old), so Android never found it and every handshake failed with "Trust anchor for certification path not found".
• Sift no longer mistakes a device that doesn't trust its certificate for pinning. A client that rejects every host is reported as untrusting, its hosts aren't saved as learned pins, and they're decrypted again as soon as it trusts Sift. Installing the CA on the emulator clears the bad pins left by earlier versions.
• Emulator traffic from newer emulators (which route through netsimd) is tagged with the app again.

Sift 2.2.1

• Emulator: new "Sift device", created automatically from a rootable Google APIs image with 4 GB RAM and the GPU on. The first boot takes about a minute. Later launches resume from a quickboot snapshot in under 20 seconds, and "System UI isn't responding" no longer appears.
• Sift's certificate is now trusted by apps on Android 14 and later (bind-mounted into the Conscrypt APEX in each app's namespace).
• Other AVDs boot with the GPU on and at least 3 GB RAM. Devices that are already running, including USB phones, are listed, and Stop leaves them running.
• Apps: fixed "Couldn't open this file" on findings after background decompiling finished. Large strings dumps open at the lines around the finding and are fully scanned.

Sift 2.2.0

Adds the Scan tab: passive analysis of captured traffic and an active vulnerability scanner (reflected XSS, SQL injection, SSTI, command injection, path traversal, open redirect, SSRF, CRLF, XXE, NoSQL injection) with baseline comparison, content discovery and parameter mining.

Adds an AI layer (OpenAI-compatible, Anthropic and Gemini, including local models via Ollama/vLLM) for triage, correlation, test recommendations and verification, with a model-per-task routing and fallbacks.

Adds a token-gated MCP server so an external AI agent can read findings and traffic and drive scans.

Findings carry severity, confidence, evidence, reproduction steps and remediation, and link back to the exact request.

Sift 2.1.0

Adds TLS fingerprint impersonation and the Jar.

TLS fingerprints. Every request the Sender and Jar send can impersonate a real client's TLS
and HTTP/2 fingerprint, using tls-client. Pick from
83 profiles — Chrome, Firefox, Safari (desktop and iOS), Edge, Opera, Brave, OkHttp. A route
carries a default; the toolbar dropdown overrides it per tab.

It changes what the server actually sees:

	Go default	chrome_131
JA3	d6627faa72aa91c9e2ae51d456173c69	a19ab9f02aacf42deddc1f2acb3d3f63
JA4	t13d2512h2_b78ed14e2fd0_ab7e3b40a677	t13d1516h2_8daaf6152771_02713d6af862

Headers also go out in the order you typed them, passed through to HTTP/2 as the header order.
A Chrome JA3 with Go's alphabetical header order still reads as a bot, so both halves matter.
Works through every route, including an upstream HTTP or SOCKS5 proxy and Sift's own proxy.
Routes can also force HTTP/1.1.

Jar. A new tab that takes a URL and shows you everything about its cookies. It walks the
redirect chain keeping a jar like a browser would, and per hop shows the cookies sent, the
Set-Cookie headers received with domain, path, expiry and flags, and both header sets. The
Find box searches all of that at once, as plain text or regex, and says where each hit came
from. Every hop is also a normal row in the Traffic tab.

The binary is 18 MB now, up from 11.5 MB — that is the cost of utls and quic-go.

SHA-256: 35b4ffc51cb1c5fc1877d3c9c1f2bc9fae6d78ae19ac075916da086b855b007e

Windows x64. MIT.

Sift 2.0.0

First tagged build.

Download sift.exe below and run it. Nothing to install — no Java, no runtime. The dashboard
opens at http://127.0.0.1:9091.

On first run: Certificate → Install (Windows will ask you to confirm), then tick
System proxy. Your proxy settings are restored when you close it, including after a crash.

What's in it

• Traffic — HTTP, HTTPS, HTTP/2, h2c and WebSockets, decrypted and shown live, with the
  program that sent each request. JSON tree, timing, cookies, hex, raw. Breakpoints, Map Local
  and Map Remote, block and rewrite rules, throttling. HAR and Postman export.
• Sender — edit any captured request as raw HTTP and send it again. Route it straight out,
  back through Sift so your own rules apply, or via an upstream HTTP or SOCKS5 proxy with
  authentication. Routes can pin which network interface to leave from. Per-tab history and a
  diff against the previous send.
• Apps — drop in an APK or IPA to get its endpoints, hardcoded secrets, certificate pinning,
  auth and captcha screens, deep links and trackers. One click boots it in an emulator routed
  through Sift, with optional Frida unpinning.

SHA-256: 100f17c6ec75336a4f6588765b7627067ad6b597b56b9b2f7d304b5406ed637a

Windows x64. MIT.