Skip to content

2.0.0

Latest
Latest

Choose a tag to compare

View all tags
@pablosnt pablosnt released this 22 Aug 15:37
· 8 commits to main since this release
Immutable release. Only release title and notes can be modified.
2.0.0-1
bdc406e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Added

  • Brand new user interface, rebuilt from scratch with Nuxt (#298)
  • Optimization and restructuring of the backend from scratch, to make it simpler, faster and safer (#222)
  • Triage of the findings as true positive, false positive or won't fix, with a comment to explain the decision (#283)
  • Mark findings as fixed manually or automatically when the executions that used to detect them stop reporting them (#284)
  • Generation of reports in PDF, JSON or XML with the findings matching the user's criteria (#273)
  • Customization of the HTML template used to generate the PDF reports (#273)
  • Alerting system that notifies each alert's subscribers when a finding matches the alert's criteria (#301)
  • Pentesting notes linkable to the rest of Rekono entities with a rich text editor that supports code blocks, tables, task lists and images (#267)
  • Integration with VirusTotal to get the reputation, the malicious analysis and the WHOIS information of the identified hosts (#354)
  • Integration with HackTricks to link the identified assets with related wiki resources (#271)
  • Integration with CVE Crowd to identify which detected CVEs are trending on social media (#301)
  • Enrichment of the vulnerabilities with the CVSS score and vector, the EPSS score and percentile, the CWEs and the remediation of their CVE (#369)
  • Integration with EPSS FIRST to enrich the vulnerabilities with the EPSS score and percentile of their CVE (#369)
  • Integration with VulnCheck NVD++ to enrich the vulnerabilities with the data of their CVE (#369)
  • Integration with GitHub Security Advisories to enrich the vulnerabilities with the data of their CVE (#369)
  • Integration with Open Source Vulnerabilities to enrich the vulnerabilities with the data of their CVE (#369)
  • Integration with EU Vulnerability Database to enrich the vulnerabilities with the data of their CVE (#369)
  • Selection of the CVE provider based on the quality of the information provided (#369)
  • New monitor job that keeps the vulnerabilities with CVE up to date and cleans the stale executions (#222)
  • Support for NVD NIST API keys, which increase the rate limits and speed up the enrichment of the vulnerabilities (#325)
  • Defect-Dojo imports can reimport the scans and close the findings that are not detected anymore (#363)
  • Get the domain and the geolocation of every host discovered (#337)
  • Customization of the HTTP headers sent by the tools, for the whole instance, for one user or for one target (#297)
  • Customization of the proxies used during executions, configurable for HTTP, HTTPS, FTP and all the protocols (#265)
  • Path in the target ports to limit the scope of the executions (#222)
  • Download of the original reports generated by the tools (#264)
  • Visualization of the commands executed by each execution (#380)
  • Detection of the hacking tools installed in the system and their versions (#357)
  • Finding pages with the finding metadata, its exposure window and its related findings (#298)
  • Metrics pages with more KPIs and stats (#298)
  • Creation of findings from user-provided data, like targets, target ports or input technologies, in order to keep the relationships between findings consistent (#340)
  • Light and dark themes (#298)
  • Users can change their email address (#299)
  • Administrators can check the status and the stats of the queues (#266)
  • Administrators can enable and disable integrations (#269)
  • Follow the redirections when calculating the URLs to be scanned, so the tools are executed against the final location (#380)
  • New default wordlists for CMS, APIs, GraphQL and specific services (#371)
  • Official Docker images published in Docker Hub for linux/amd64 and linux/arm64 (#345)

Changed

  • Upgrade PostgreSQL version from 14 to 18, migrating the data of Rekono 1.x automatically in Docker deployments (#386)
  • Upgrade required Python version to 3.11 (#222)
  • The SMTP configuration is stored in the database, so it is removed from the configuration file and from the RKN_EMAIL_* environment variables (#222)
  • Replace Redis by Valkey (#373)
  • Upgrade required Dirsearch version to 0.5.0 (#393)
  • Run EmailHarvester from its source code, instead of the outdated Kali Linux package (#380)
  • New logo and favicon (#298)
  • New email templates based on react-email for the notifications sent through SMTP (#375)
  • Send emails using new threads instead of the emails-queue Redis queue (#222)
  • Input technologies and vulnerabilities are provided when a scan is created, instead of being saved in the target (#323)
  • The address field of the hosts is renamed to ip (#222)
  • Replace the /api/system/ endpoint by /api/settings/ and one endpoint for each integration (#269)
  • Tool arguments are defined per configuration, so only the inputs that each configuration really needs are requested (#360)
  • Backend and frontend Docker images are based on distroless images, so they are smaller and ship less software than the Rekono 1.x ones (#345)
  • TLS certificates of the Docker deployment are kept in a volume, instead of the docker/nginx/tls directory (#345)
  • Executions store the Defect-Dojo test that they create, instead of just knowing that they were imported (#363)
  • The Telegram bot creates the authentication of a target port within the /newport command (#222)
  • The Telegram bot asks for the wordlists, technologies and vulnerabilities that each scan needs (#323)
  • The Telegram bot asks for the target port to be scanned (#380)
  • The Telegram notifications link to the scans in the user interface (#380)
  • Default processes updated with the new tool configurations (#360)
  • Rename the tasks-queue, executions-queue and findings-queue queues to tasks, executions and findings (#277)
  • Use uv to manage the backend dependencies and to run the Rekono commands (#342)
  • Use pnpm to manage the frontend dependencies (#298)
  • Upgrade Django version to 5.2.17 (#222)
  • Upgrade djangorestframework version to 3.18.0 (#222)
  • Upgrade djangorestframework-simplejwt version to 5.5.1 (#222)
  • Upgrade django-filter version to 26.1 (#222)
  • Upgrade django-rq version to 4.1.1 (#222)
  • Upgrade django-taggit version to 6.1.0 (#222)
  • Upgrade drf-spectacular version to 0.30.0 (#222)
  • Upgrade rq version to 2.10.0 (#222)
  • Upgrade python-telegram-bot version to 22.8 (#222)
  • Upgrade requests version to 2.34.2 (#389)
  • Upgrade pycryptodome version to 3.23.0 (#389)
  • Upgrade pyjwt version to 2.13.0 (#389)
  • Upgrade pyyaml version to 6.0.3 (#389)
  • Upgrade tornado version to 6.5.8 (#389)
  • Upgrade python-magic version to 0.4.27 (#222)
  • Replace psycopg2 by psycopg version 3.3.4 (#389)
  • Replace Vue 2 by Vue 3 and Nuxt 4 (#298)
  • Replace BootstrapVue by Nuxt UI (#298)
  • Replace Chart.js by Unovis to draw the charts (#298)

Deprecated

  • Automatic migration of data from Rekono 1.x to 2.x will be removed in the short term (#386)
  • Tool configurations that don't work anymore are marked as deprecated, so they can't be used in new scans but the old executions keep their history (#360)

Removed

  • Remove Rekono Desktop, both the Electron applications and the Debian package, so Rekono is deployed with Docker or from source (#385)
  • Remove support for Rekono deployments under a specific web path with rootpath, since the NGINX configuration, frontend and backend URLs are enough (#299)
  • Remove deprecated settings (#222)
  • Remove tasks status, because the status of a scan comes from its executions (#222)
  • Remove scheduled_in from the scans, as it is covered by scheduled_at (#304)
  • Remove findings fields first_seen, last_seen, detected_by and is_active that are replaced by their executions, triage and fixed status (#283)
  • Remove the enable and disable operations over the findings, replaced by the triage and the fixed status (#283)
  • Remove steps priority (#222)
  • Remove the /newauth, /newtechnology and /newvulnerability commands from the Telegram bot, since these values are requested when they are needed (#323)
  • Remove support for the EmailFinder tool, since it has been archived by its author (#380)
  • Remove the Endpoints list for Dirsearch, WebLogic and WebSphere default wordlists, whose files are not provided anymore (#386)

Fixed

  • Verify and fix all the tool parsers to support the latest report formats, keeping the support for the previous ones (#339)
  • Fix the tool commands, and improve the output that the executions generate (#351)
  • Fix Schedule and Repeat sections of the scan form (#219)
  • Fix the creation of multiple engagements in Defect-Dojo to import scans from the same target (#222)
  • Fix the Defect-Dojo scan types used for each tool, so the findings are imported as expected (#363)
  • Remove the duplicated API field used to sort the data (#222)

Security

  • User sessions are kept in HttpOnly cookies instead of the browser storage, and refreshed silently (#365)
  • Multi-Factor Authentication (MFA) via authenticator apps or email (#303)
  • Administrators decide what can be scanned and what can't, with a denylist of targets, patterns and IP networks (#222)
  • Management of multiple personal API tokens with expiration dates (#222)
  • New configuration property to enable the encryption of sensitive data like Defect-Dojo API keys, Telegram tokens or authentication credentials when stored in the database (#222)
  • New management commands to create, rotate and remove the encryption key (#222)
  • Credentials and internal details are masked or removed from the execution commands, outputs and reports (#288)
  • Close user sessions and unlink the Telegram bot when the user's password changes (#222)
  • New endpoints to manage Content Security Policy reports sent via the report-to and report-uri directives (#362)
  • Docker images run with unprivileged users and without new privileges (#345)
Assets 3
Loading
0 Join discussion