Skip to content

v3.2.2

Latest
Latest

Choose a tag to compare

View all tags
@hahwul hahwul released this 31 Aug 12:36
· 26 commits to main since this release
v3.2.2
7bb684f

3.2.2

Request-construction / input-validation hardening, new WAF fingerprints, and shell-completion + man-page packaging.

  • Hardened request building and input validation: header-value checks, raw-HTTP //-target Host hijack, duplicate Content-Type, HAR empty cookies, query injection leaking into the URL fragment, and fail-fast on unroutable --proxy / non-http --sxss-url / failed --cookie-from-raw (#1404, #1396, #1389, #1384).
  • MCP no longer caches the scan runtime in thread-local storage (fixes a Windows hang), and two stray panics no longer abort a whole scan (#1398, #1367).
  • Server / MCP stop discarding proxy / callback_url and report a correct preflight estimate; config files no longer override explicitly typed CLI flags (#1388, #1372).
  • New WAF fingerprints: Wallarm, NAXSI, SafeLine (#1364).
  • dalfox completion for shell completions and a generated man page, both installed by the packages (#1374, #1365, #1380).
  • dalfox payload: a javascript selector and slash-separated attribute breakouts for space-stripping filters (#1386, #1402).

Full Changelog: v3.2.1...v3.2.2

Assets 26
Loading