Skip to content

v0.5.3

Choose a tag to compare

View all tags
@github-actions github-actions released this 09 Jul 17:28
· 236 commits to main since this release
v0.5.3
cc5ee5b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Changelog

All notable changes to this project will be documented here

0.5.3 - 2026-07-09

✨ New features

  • Docs: add 5 new attack modes + search flags to command reference - (b6b042b)
    • attack: add memory-dump, container-escape, supply-chain-worm, - (b6b042b)
    • search: add --language, --topic, --path-exists, --path-pattern, - (b6b042b)
  • Docs: add command reference pages for explain, pbom, query, secretscan - (018c061)
    • enumerate: add Plumber compliance features (--score, --badge, - (018c061)
    • astro.config.mjs: add sidebar entries for all 4 new pages - (018c061)
  • Fix: resolve 4 bugs in advanced attack modes — CLI flags, artifact support - (abc3687)
    • memory-dump: add artifacts block and copy memdump_* files to working - (abc3687)
    • container-escape: add artifacts block and copy escape_* files to - (abc3687)
  • .gogatoz.yaml support for configurable forbidden tags, authorized registries, - (1d1f590)
    • 6 new renderPayload() cases for --payload-only support - (8a2ca6a)
    • attack: add Value field to injectVar struct (was using key as value) - (19abe8e)
    • attack: add 5 missing payload types to renderPayload switch - (19abe8e)
    • container_escape: add image name + sh -c wrapper to docker run - (19abe8e)
    • container_escape: add missing fi for privileged check block - (19abe8e)
    • query: add evidence column to findings table, handle unknown severities - (19abe8e)

✨: New features

  • Feat: port Plumber compliance features — 11 new detections, SARIF/GLSAST/PBOM output, scoring, MR comments, badges, config system - (1d1f590)
  • Feat: implement Shai-Hulud gap features — 6 new payload modules + enhancements - (8a2ca6a)

🐛 Bug fixes

  • Fix: resolve 10 adversarial review findings in Plumber compliance port - (6c3e416)
    • fix UUID operator precedence in CycloneDX generateSerialNumber (94% invalid) - (6c3e416)
    • fix scoring inversion by grouping by code only, using worst severity weight - (6c3e416)
    • fix FP finding count inconsistency in report Summary vs severity breakdown - (6c3e416)
    • fix apk/apt-get extraCheck to examine all packages, not just the first - (6c3e416)
  • Fix: resolve 7 adversarial review findings across attack modules - (41165b7)
  • Fix: resolve all 15 golangci-lint issues + review Qwen3.6 Codex fixes - (3998aa8)
  • Fix: resolve 25 bugs from code review (6 critical, 8 high, 11 medium) - (19abe8e)
    • ror_listener: fix timer leak in WaitFor (create timer once before loop) - (19abe8e)
    • ror_listener: fix data race on Listener.srv and len(l.results) - (19abe8e)
    • query: fix redactValue exposing full short secrets - (19abe8e)
    • variable_injection: fix callback JSON project field, fix URL encoding - (19abe8e)
    • attack: fix error message, remove unnecessary branch in variable-inject - (19abe8e)
  • Fixes - (2dc3f5a)

🎨 Styling

  • Style: gofmt whitespace fixes across 14 files - (f3e5fad)

🛠 Improvements

  • Update CLAUDE.md CTF section to 26 flags / 9950 pts across 6 tracks - (f863782)
  • Update .gitignore - (bfbcdcd)
  • Update .gitignore - (747dd59)
  • Update .gitignore - (bfe2177)
  • Update .gitignore - (6397d10)

⚙️ Miscellaneous

  • Merge pull request #9 from mr-pmillz/develop - (cc5ee5b)
  • New attacks, fixes and updates - (cc5ee5b)
  • Merge pull request #8 from mr-pmillz/feat/attack-fixes - (41ac58d)
  • Feat/attack fixes - (41ac58d)
  • variable-inject, c2-channel mode descriptions, option sections, - (b6b042b)
  • and examples (#19-23) - (b6b042b)
  • --output, --format flags and examples for code search, CI-only - (b6b042b)
  • projects, and search-to-enumerate pipeline - (b6b042b)
  • Co-Authored-By: Claude Opus 4.6 (1M context) noreply@anthropic.com - (b6b042b)
    • explain: finding code lookup with --list, --all, --json - (018c061)
    • pbom: Pipeline Bill of Materials with CycloneDX 1.5 SBOM output - (018c061)
    • query: SQLite database queries for sessions, findings, secrets, - (018c061)
  • credentials, attacks, exfil data (7 subcommands) - (018c061)
    • secretscan: clone + TruffleHog/Gitleaks/Titus scanning with - (018c061)
  • project discovery, clone depth, offline mode - (018c061)
  • --mr-comment, --format sarif|glsast, --log-scrape, --group, - (018c061)
  • --filter-false-positives) with 7 new example sections - (018c061)
  • Co-Authored-By: Claude Opus 4.6 (1M context) noreply@anthropic.com - (018c061)
  • Go fix ./... - (ac2c0e7)
  • Co-Authored-By: Claude Opus 4.6 (1M context) noreply@anthropic.com - (f3e5fad)
    • container-escape: use --tags/--image CLI flags instead of hardcoded - (abc3687)
  • ["docker"] and "docker:dind"; pass through ExfilMethod, ExfilTarget, - (abc3687)
  • and all CommonOptions - (abc3687)
    • c2-channel: use --tags/--image CLI flags instead of hardcoded - (abc3687)
  • ["shell_executor"] and "alpine:latest"; pass through CommonOptions - (abc3687)
  • dir before cleanup — previously all collected data was rm'd with no - (abc3687)
  • artifact configuration - (abc3687)
  • working dir before cleanup — same data-loss fix - (abc3687)
  • Co-Authored-By: Claude Opus 4.6 (1M context) noreply@anthropic.com - (abc3687)
  • 4 high-severity fixes: - (6c3e416)
    • move scoring, sidecar output, MR comment, badge before format early-returns - (6c3e416)
    • handle GitLab expanded variable syntax in resolveVariable and detectDebugTrace - (6c3e416)
  • 6 medium-severity fixes: - (6c3e416)
    • error on explicit --config pointing to nonexistent file - (6c3e416)
    • exclude local path installs (pip install .) from unpinned package detection - (6c3e416)
    • use actual finding severity for SARIF rule security-severity property - (6c3e416)
  • Co-Authored-By: Claude Opus 4.6 (1M context) noreply@anthropic.com - (6c3e416)
  • Phase 1: Central finding code registry (pkg/analyze/codes.go) with 37 finding IDs - (1d1f590)
  • And explain command (gogatoz explain --list --all --json). Refactored - (1d1f590)
  • WithRecommendations() to use registry lookup. - (1d1f590)
  • Phase 2: 11 new GitLab CI/CD detections ported from Plumber's rule set: - (1d1f590)
    • DEBUG_TRACE_ENABLED: CI_DEBUG_TRACE/CI_DEBUG_SERVICES secret exposure - (1d1f590)
    • DIND_DETECTED / DIND_INSECURE: Docker-in-Docker + insecure TLS config - (1d1f590)
    • IMAGE_MUTABLE_TAG / IMAGE_NOT_PINNED: container image supply chain - (1d1f590)
    • SECURITY_JOB_WEAKENED: allow_failure/manual/never on SAST/DAST jobs - (1d1f590)
    • INCLUDE_FORBIDDEN_VERSION: mutable branch refs on project includes - (1d1f590)
    • JOB_HARDCODED: jobs not from includes/components (stub, needs provenance) - (1d1f590)
    • UNVERIFIED_SCRIPT_EXEC: base64|bash, download-then-exec patterns - (1d1f590)
    • UNPINNED_PACKAGE_INSTALL: pip/npm/gem/go/apk/apt without version pins - (1d1f590)
    • SCRIPT_OBFUSCATION: zero-width chars, bidi overrides (Trojan Source) - (1d1f590)
  • Phase 3: SARIF 2.1.0 output (--format sarif, --sarif-output) for GitHub Code - (1d1f590)
  • Scanning and GitLab SAST v15.0.4 report (--format glsast, --glsast-output) for - (1d1f590)
  • GitLab Security Dashboard integration. - (1d1f590)
  • Phase 4: Compliance scoring (A-E letter grades, scoring-v3 algorithm with - (1d1f590)
  • Per-severity weights, logarithmic growth, critical malus). MR comment - (1d1f590)
  • Integration (--mr-comment ), project badge management (--badge), and - (1d1f590)
  • Score display in pterm output (--score). - (1d1f590)
  • Phase 5: Analysis controls configuration system (pkg/config/) with - (1d1f590)
  • Security job patterns, debug trace vars, trusted script URLs, and disabled - (1d1f590)
  • Rules. Commands: gogatoz config init, gogatoz config show. - (1d1f590)
  • Phase 6: Pipeline Bill of Materials (pkg/pbom/) with container image inventory, - (1d1f590)
  • Include tracking, deduplication, and CycloneDX 1.5 conversion. Command: - (1d1f590)
  • Gogatoz pbom --project --format json|cyclonedx. - (1d1f590)
  • Co-Authored-By: Claude Opus 4.6 (1M context) noreply@anthropic.com - (1d1f590)
  • Supply chain worm: - (41165b7)
    • Fix invalid YAML generation by wrapping payload in block scalar (- |) - (41165b7)
    • Use Groups.ListGroupProjects instead of Projects.ListProjects for - (41165b7)
  • sibling discovery — the old API with Owned:true missed group-member - (41165b7)
  • projects - (41165b7)
    • Fix caller checking result.Errors (always 0) instead of result.Failed - (41165b7)
  • ROR listener: - (41165b7)
    • Replace fire-and-forget goroutine + time.Sleep(200ms) with Ready() - (41165b7)
  • channel — caller now selects on ready/error/timeout before committing - (41165b7)
  • the attack payload - (41165b7)
    • Add 5s grace period in WaitFor after first callback to capture - (41165b7)
  • multi-runner results - (41165b7)
    • Default listen address to 127.0.0.1:9444 instead of 0.0.0.0 - (41165b7)
    • Cap results at 100, return 429 on overflow - (41165b7)
    • Upgrade sync.Mutex to sync.RWMutex for read-path concurrency - (41165b7)
    • Fix goroutine leak via localCancel derived from parent context - (41165b7)
  • Branch mutator: - (41165b7)
    • Replace piped while loop with temp file redirect so counter variables - (41165b7)
  • (_targeted, _mutated, _errors) survive the loop in POSIX sh - (41165b7)
  • Added LOTP Track (flags 16-20) and Advanced Attack Track (flags 21-26) - (f863782)
  • To the CTF Lab Environment documentation. Updated total from 15 flags / - (f863782)
  • 5750 pts to 26 flags / 9950 pts. - (f863782)
  • Co-Authored-By: Claude Opus 4.6 (1M context) noreply@anthropic.com - (f863782)
  • Qwen3.6 fixes reviewed and verified: - (3998aa8)
    • memorydump: YAML block scalar with indentScript (was - %s) - (3998aa8)
    • supplychain_worm: YAML block scalar with indentScript - (3998aa8)
    • attacker: SetProjectVariable/SetGroupVariable 404 → CreateVariable fallback - (3998aa8)
  • Golangci-lint fixes: - (3998aa8)
    • dupl: extract commitPayloadToBranch helper, nolint for vault/sigstore - (3998aa8)
    • errorlint: errors.Is(err, http.ErrServerClosed) - (3998aa8)
    • gocognit: extract discoverSiblings, buildWormCI, injectWormPayload, - (3998aa8)
  • commitToBranch helpers to reduce RunSupplyChainWorm and RunBranchMutator - (3998aa8)
    • gocritic: if-else chain → switch in container_escape exfil - (3998aa8)
    • gosec G118: nolint for intentional context.Background in shutdown goroutine - (3998aa8)
    • ineffassign: remove unused payload variable in worm script builder - (3998aa8)
    • staticcheck QF1012: WriteString(fmt.Sprintf) → fmt.Fprintf across all - (3998aa8)
  • payload files (c2_channels, branchmutator, npm_tamper, sigstore, - (3998aa8)
  • deadmanswitch, k8s_secrets, vault_enum, memorydump, supplychain_worm, - (3998aa8)
  • variable_injection, container_escape) - (3998aa8)
    • staticcheck QF1003: if-else → switch on ExfilMethod in supplychain_worm - (3998aa8)
    • staticcheck S1039: remove unnecessary fmt.Sprintf in npm_tamper - (3998aa8)
    • unused: remove unused coAuthorTrailer function - (3998aa8)
  • Codex code review, hermes qwen3.6 fix attempt 1 - (d63f7e7)
  • New payload modules in pkg/attack/payloads/: - (8a2ca6a)
    • npm_tamper: npm supply chain package tampering (preinstall hook injection) - (8a2ca6a)
    • vault_enum: HashiCorp Vault secret enumeration (token/k8s/aws auth) - (8a2ca6a)
    • k8s_secrets: Kubernetes API secret sweep with credential pattern scanning - (8a2ca6a)
    • deadmanswitch: systemd/LaunchAgent persistence with token revocation handler - (8a2ca6a)
    • branchmutator: multi-branch commit injection via REST API + SDK - (8a2ca6a)
    • sigstore: SLSA provenance forgery (Fulcio + Rekor + DSSE envelope) - (8a2ca6a)
  • Infostealer enhancements (Phase A): - (8a2ca6a)
    • Expanded credential sweep: 25+ new paths (AI tools, chat/IM, VPN, K8s SA, Docker, 12+ crypto wallets) - (8a2ca6a)
    • gh auth token extraction for GitHub CLI tokens - (8a2ca6a)
    • Recursive .env file sweep at up to 5 levels deep - (8a2ca6a)
  • Infrastructure (Phase C): - (8a2ca6a)
    • CoAuthor field added to CommonOptions for commit attribution - (8a2ca6a)
    • Multi-channel exfil fallback method in payloadExfilScript - (8a2ca6a)
  • CLI wiring (cmd/attack.go): - (8a2ca6a)
    • 6 new mode flags with handler blocks - (8a2ca6a)
    • ~25 new CLI flags registered in init() - (8a2ca6a)
  • Documentation: - (8a2ca6a)
    • attack.md: 6 new option subsections + 6 examples - (8a2ca6a)
    • New use case page: advanced-supply-chain.md - (8a2ca6a)
    • Updated post-compromise.md with Vault/K8s sections - (8a2ca6a)
    • Updated persistence.md with Dead Man's Switch - (8a2ca6a)
    • Sidebar entry added to astro.config.mjs - (8a2ca6a)
  • Tests: - (8a2ca6a)
    • 6 new payload unit test files with table-driven mustParse tests - (8a2ca6a)
    • 3 new infostealer test cases for expanded features - (8a2ca6a)
    • 6 new E2E --payload-only tests - (8a2ca6a)
  • Critical fixes: - (19abe8e)
    • c2_channels: remove spurious fmt.Sprintf args (broke go vet/test) - (19abe8e)
    • memorydump: use bundle.tgz when encryption disabled (was referencing nonexistent bundle.enc) - (19abe8e)
  • High fixes: - (19abe8e)
    • attack: wire --inject-protected/--inject-masked flags into handler - (19abe8e)
    • attack: switch memory-dump to GenerateMemoryDumpYAML with proper options - (19abe8e)
  • Medium fixes: - (19abe8e)
    • attack: implement parsePipelineURL (was stub returning 0) - (19abe8e)
    • query: remove dead dbPath params, unused vars, non-functional flags - (19abe8e)
    • memorydump: initialize $_memcount before conditional blocks - (19abe8e)
    • supplychain_worm: remove unused _ parameter from RunSupplyChainWorm - (19abe8e)
    • ror_listener: remove unused struct fields - (19abe8e)
  • Go fix ./... - (2403a2c)
  • Go fmt ./... - (ad4eb06)
  • Hermes attack techniques and payloads. needs Code Review - (f4a8b17)
  • Ror fixes and query loot - (5357eac)
Assets 11
Loading