WebScan v2.7.1 — Stealth Mode + README Refresh

WebScan v2.7.1 — Stealth Mode + README Refresh

🥷 --stealth mode — full WAF/IDS evasion

New --stealth flag for maximum evasion when scanning WAF-protected targets:

webscan -t https://target.com --stealth --proxy socks5://127.0.0.1:9050

What stealth mode does:

• Forces --random-agent (browser UA rotation on every request)
• Forces --random-delay (request jitter ×0.5–×1.5)
• Sets concurrency=1 (single connection, no parallelism)
• Floors delay at 2.0s (at least 2s between requests)
• Injects random X-Forwarded-For header (random public IPv4)
• Injects random Referer header (Google/Bing/DuckDuckGo search URL)
• Reduces connection pool to 1 connection per host
• Combines with --proxy for Tor routing

No other open-source DAST scanner has a built-in stealth mode — you'd need to manually configure each evasion technique separately.

📝 README refresh

All numbers updated to v2.7.0/v2.7.1:

• 41 plugins (was 38 — added dns_security, csp_analyzer, waf_detect)
• 937 tests (was 840)
• 69 source files (was 61)
• v2.7.0 in benchmark table (was v2.5.0)
• 14 of 41 passive plugins (was 11 of 38)
• Added 3 new plugins to the plugins table
• Added --stealth to bug hunters section + all flags
• Added DevOps & reporting subsection (risk score, compliance, diff, webhook, autofix)
• Updated architecture diagram with all new modules

🔧 CORS fix

Restored the explicit CORS deny-all middleware in server.py that was dropped during the v2.7.0 rebase.

📊 Numbers

• 41 plugins (unchanged)
• 937 tests passed (+12 stealth tests)
• 69 source files (unchanged)
• ruff clean, mypy --strict clean, 0 test failures