2.0.0

[pablosnt]

Added

• Brand new user interface, rebuilt from scratch with Nuxt (Optimize frontend #298)
• Optimization and restructuring of the backend from scratch, to make it simpler, faster and safer (Optimize backend code #222)
• Triage of the findings as true positive, false positive or won't fix, with a comment to explain the decision (Handle findings triage #283)
• Mark findings as fixed manually or automatically when the executions that used to detect them stop reporting them (Handle fixed findings #284)
• Generation of reports in PDF, JSON or XML with the findings matching the user's criteria (Export findings to JSON, XML or PDF #273)
• Customization of the HTML template used to generate the PDF reports (Export findings to JSON, XML or PDF #273)
• Alerting system that notifies each alert's subscribers when a finding matches the alert's criteria (Alert system #301)
• Pentesting notes linkable to the rest of Rekono entities with a rich text editor that supports code blocks, tables, task lists and images (Add support for pentesting notes #267)
• Integration with VirusTotal to get the reputation, the malicious analysis and the WHOIS information of the identified hosts (VirusTotal #354)
• Integration with HackTricks to link the identified assets with related wiki resources (Add HackTricks references #271)
• Integration with CVE Crowd to identify which detected CVEs are trending on social media (Alert system #301)
• Enrichment of the vulnerabilities with the CVSS score and vector, the EPSS score and percentile, the CWEs and the remediation of their CVE (Evaluate NVD NIST situation as CVE provider #369)
• Integration with EPSS FIRST to enrich the vulnerabilities with the EPSS score and percentile of their CVE (Evaluate NVD NIST situation as CVE provider #369)
• Integration with VulnCheck NVD++ to enrich the vulnerabilities with the data of their CVE (Evaluate NVD NIST situation as CVE provider #369)
• Integration with GitHub Security Advisories to enrich the vulnerabilities with the data of their CVE (Evaluate NVD NIST situation as CVE provider #369)
• Integration with Open Source Vulnerabilities to enrich the vulnerabilities with the data of their CVE (Evaluate NVD NIST situation as CVE provider #369)
• Integration with EU Vulnerability Database to enrich the vulnerabilities with the data of their CVE (Evaluate NVD NIST situation as CVE provider #369)
• Selection of the CVE provider based on the quality of the information provided (Evaluate NVD NIST situation as CVE provider #369)
• New monitor job that keeps the vulnerabilities with CVE up to date and cleans the stale executions (Optimize backend code #222)
• Support for NVD NIST API keys, which increase the rate limits and speed up the enrichment of the vulnerabilities (Support NVD NIST API keys #325)
• Defect-Dojo imports can reimport the scans and close the findings that are not detected anymore (Verify DefectDojo integration #363)
• Get the domain and the geolocation of every host discovered (Get more information automatically for each host identified #337)
• Customization of the HTTP headers sent by the tools, for the whole instance, for one user or for one target (Configure custom HTTP headers #297)
• Customization of the proxies used during executions, configurable for HTTP, HTTPS, FTP and all the protocols (Custom proxy configuration for executions #265)
• Path in the target ports to limit the scope of the executions (Optimize backend code #222)
• Download of the original reports generated by the tools (Download original reports generated by tools #264)
• Visualization of the commands executed by each execution (Fix bugs identified during second testing phase #380)
• Detection of the hacking tools installed in the system and their versions (Fix pending TODOs #357)
• Finding pages with the finding metadata, its exposure window and its related findings (Optimize frontend #298)
• Metrics pages with more KPIs and stats (Optimize frontend #298)
• Creation of findings from user-provided data, like targets, target ports or input technologies, in order to keep the relationships between findings consistent (Always ensure relationships between findings #340)
• Light and dark themes (Optimize frontend #298)
• Users can change their email address (Release 2.0.0 #299)
• Administrators can check the status and the stats of the queues (New endpoint to get RQ status and stats #266)
• Administrators can enable and disable integrations (Allow administrators to enable and disable integrations #269)
• Follow the redirections when calculating the URLs to be scanned, so the tools are executed against the final location (Fix bugs identified during second testing phase #380)
• New default wordlists for CMS, APIs, GraphQL and specific services (Add new API wordlists #371)
• Official Docker images published in Docker Hub for linux/amd64 and linux/arm64 (Adapt and optimize Docker images #345)

Changed

• Upgrade PostgreSQL version from 14 to 18, migrating the data of Rekono 1.x automatically in Docker deployments (Data migration from Rekono 1.x to 2.x #386)
• Upgrade required Python version to 3.11 (Optimize backend code #222)
• The SMTP configuration is stored in the database, so it is removed from the configuration file and from the RKN_EMAIL_* environment variables (Optimize backend code #222)
• Replace Redis by Valkey (Replace Redis by Valkey #373)
• Upgrade required Dirsearch version to 0.5.0 (Upgrade dirsearch to latest version #393)
• Run EmailHarvester from its source code, instead of the outdated Kali Linux package (Fix bugs identified during second testing phase #380)
• New logo and favicon (Optimize frontend #298)
• New email templates based on react-email for the notifications sent through SMTP (Improve notification templates #375)
• Send emails using new threads instead of the emails-queue Redis queue (Optimize backend code #222)
• Input technologies and vulnerabilities are provided when a scan is created, instead of being saved in the target (Move target parameters to task parameters #323)
• The address field of the hosts is renamed to ip (Optimize backend code #222)
• Replace the /api/system/ endpoint by /api/settings/ and one endpoint for each integration (Allow administrators to enable and disable integrations #269)
• Tool arguments are defined per configuration, so only the inputs that each configuration really needs are requested (Define arguments per configuration instead of tool #360)
• Backend and frontend Docker images are based on distroless images, so they are smaller and ship less software than the Rekono 1.x ones (Adapt and optimize Docker images #345)
• TLS certificates of the Docker deployment are kept in a volume, instead of the docker/nginx/tls directory (Adapt and optimize Docker images #345)
• Executions store the Defect-Dojo test that they create, instead of just knowing that they were imported (Verify DefectDojo integration #363)
• The Telegram bot creates the authentication of a target port within the /newport command (Optimize backend code #222)
• The Telegram bot asks for the wordlists, technologies and vulnerabilities that each scan needs (Move target parameters to task parameters #323)
• The Telegram bot asks for the target port to be scanned (Fix bugs identified during second testing phase #380)
• The Telegram notifications link to the scans in the user interface (Fix bugs identified during second testing phase #380)
• Default processes updated with the new tool configurations (Define arguments per configuration instead of tool #360)
• Rename the tasks-queue, executions-queue and findings-queue queues to tasks, executions and findings (Rename queues without the "-queue" value #277)
• Use uv to manage the backend dependencies and to run the Rekono commands (Use uv as project manager #342)
• Use pnpm to manage the frontend dependencies (Optimize frontend #298)
• Upgrade Django version to 5.2.17 (Optimize backend code #222)
• Upgrade djangorestframework version to 3.18.0 (Optimize backend code #222)
• Upgrade djangorestframework-simplejwt version to 5.5.1 (Optimize backend code #222)
• Upgrade django-filter version to 26.1 (Optimize backend code #222)
• Upgrade django-rq version to 4.1.1 (Optimize backend code #222)
• Upgrade django-taggit version to 6.1.0 (Optimize backend code #222)
• Upgrade drf-spectacular version to 0.30.0 (Optimize backend code #222)
• Upgrade rq version to 2.10.0 (Optimize backend code #222)
• Upgrade python-telegram-bot version to 22.8 (Optimize backend code #222)
• Upgrade requests version to 2.34.2 (Update dependencies #389)
• Upgrade pycryptodome version to 3.23.0 (Update dependencies #389)
• Upgrade pyjwt version to 2.13.0 (Update dependencies #389)
• Upgrade pyyaml version to 6.0.3 (Update dependencies #389)
• Upgrade tornado version to 6.5.8 (Update dependencies #389)
• Upgrade python-magic version to 0.4.27 (Optimize backend code #222)
• Replace psycopg2 by psycopg version 3.3.4 (Update dependencies #389)
• Replace Vue 2 by Vue 3 and Nuxt 4 (Optimize frontend #298)
• Replace BootstrapVue by Nuxt UI (Optimize frontend #298)
• Replace Chart.js by Unovis to draw the charts (Optimize frontend #298)

Deprecated

• Automatic migration of data from Rekono 1.x to 2.x will be removed in the short term (Data migration from Rekono 1.x to 2.x #386)
• Tool configurations that don't work anymore are marked as deprecated, so they can't be used in new scans but the old executions keep their history (Define arguments per configuration instead of tool #360)

Removed

• Remove Rekono Desktop, both the Electron applications and the Debian package, so Rekono is deployed with Docker or from source (Remove desktop app image and backend configurations #385)
• Remove support for Rekono deployments under a specific web path with rootpath, since the NGINX configuration, frontend and backend URLs are enough (Release 2.0.0 #299)
• Remove deprecated settings (Optimize backend code #222)
• Remove tasks status, because the status of a scan comes from its executions (Optimize backend code #222)
• Remove scheduled_in from the scans, as it is covered by scheduled_at (Remove scheduled_in feature in tasks #304)
• Remove findings fields first_seen, last_seen, detected_by and is_active that are replaced by their executions, triage and fixed status (Handle findings triage #283)
• Remove the enable and disable operations over the findings, replaced by the triage and the fixed status (Handle findings triage #283)
• Remove steps priority (Optimize backend code #222)
• Remove the /newauth, /newtechnology and /newvulnerability commands from the Telegram bot, since these values are requested when they are needed (Move target parameters to task parameters #323)
• Remove support for the EmailFinder tool, since it has been archived by its author (Fix bugs identified during second testing phase #380)
• Remove the Endpoints list for Dirsearch, WebLogic and WebSphere default wordlists, whose files are not provided anymore (Data migration from Rekono 1.x to 2.x #386)

Fixed

• Verify and fix all the tool parsers to support the latest report formats, keeping the support for the previous ones (Check and fix parsers compatibility #339)
• Fix the tool commands, and improve the output that the executions generate (Fix tool commands and improve execution outpus #351)
• Fix Schedule and Repeat sections of the scan form (Fix Schedule and Repeat forms in Task modal in Docker environment #219)
• Fix the creation of multiple engagements in Defect-Dojo to import scans from the same target (Optimize backend code #222)
• Fix the Defect-Dojo scan types used for each tool, so the findings are imported as expected (Verify DefectDojo integration #363)
• Remove the duplicated API field used to sort the data (Optimize backend code #222)

Security

• User sessions are kept in HttpOnly cookies instead of the browser storage, and refreshed silently (JWT authentication via cookies #365)
• Multi-Factor Authentication (MFA) via authenticator apps or email (2FA #303)
• Administrators decide what can be scanned and what can't, with a denylist of targets, patterns and IP networks (Optimize backend code #222)
• Management of multiple personal API tokens with expiration dates (Optimize backend code #222)
• New configuration property to enable the encryption of sensitive data like Defect-Dojo API keys, Telegram tokens or authentication credentials when stored in the database (Optimize backend code #222)
• New management commands to create, rotate and remove the encryption key (Optimize backend code #222)
• Credentials and internal details are masked or removed from the execution commands, outputs and reports (Hide authentication credentials in logs and outputs #288)
• Close user sessions and unlink the Telegram bot when the user's password changes (Optimize backend code #222)
• New endpoints to manage Content Security Policy reports sent via the report-to and report-uri directives (Frontend optimization #362)
• Docker images run with unprivileged users and without new privileges (Adapt and optimize Docker images #345)

---

This discussion was created from the release 2.0.0.