summit v0.6.5 - the 0.6.x line complete

Final release of the 0.6.x line. Nothing new to maintain - just the docs catching up to what the code does.

In this one

• Usage documentation now covers every command shipped in 0.6.x: authorize, mine, tls, --openapi, plus the CWE/CVE tagging in reports
• README check catalog and command table synced with reality (30+ checks across 8 check families)

The 0.6.x line, documented

Version	What landed
v0.6.0	OS command injection, SSTI, CRLF, sensitive files; CWE/CVE tagging on every finding
v0.6.1	false-positive extermination (authorize wall guard, SSTI echo guard); complete untruncated evidence
v0.6.2	time-based SQLi (calibrated), GraphQL introspection, 120 param candidates, expanded sensitive paths
v0.6.3	range-based CVE matching (packaging), Heartbleed + Ghostcat entries, YAML specs (pyyaml)
v0.6.4	redirect-following spider (FN reduction), summit tls certificate audit
v0.6.5	this release - documentation complete, 30+ checks cataloged

Verified in CI on every one of those releases

73 tests, ruff clean, demo-scan smoke test, evidence runner 21/21.

Authorized testing only.

summit v0.6.4 - redirect-following spider, TLS audit

A false-negative reduction pass plus a new standalone audit command.

Spider follows redirects

The crawler previously dropped endpoints behind 302s - a systematic false-negative source (whole app sections live behind login redirects). Crawl GETs now follow redirect chains; active checks keep allow_redirects=False because probe semantics demand it.

summit tls <host> - certificate and protocol audit

Connects once, reads the served certificate, and checks what actually bites:

• expired certificate (CWE-295, confirmed - dates do not lie)
• certificate expiring within 14 days (low, potential)
• self-signed certificate (CWE-295, confirmed - issuer equals subject)
• TLSv1.0 / TLSv1.1 handshakes accepted (CWE-326, confirmed - we complete those handshakes ourselves)

Standalone by design: it talks to the network by definition, so it is a command, not a scan phase. Verdict logic is pure and unit-tested; certificate decoding is stdlib-only.

73 tests, evidence 21/21. CI green.

summit v0.6.3 - range-based CVEs, modern database, YAML specs

The CVE database grows up - from exact-string matching to proper version ranges, plus new dependencies that earn their place.

New dependencies (requirements.txt / pyproject)

• packaging>=23.0 - correct PEP-440 version comparison for CVE ranges (0.3 < 0.10 the way humans mean it)
• pyyaml>=6.0 - YAML OpenAPI specs load natively, no conversion step

CVE database modernized

• ranges replace exact strings: >=2.4.49,<2.4.50 style, matched with packaging
• Heartbleed (CVE-2014-0160) added for OpenSSL 1.0.1 through 1.0.1f (non-PEP440 versions handled via exact lists)
• Ghostcat (CVE-2020-1938) added with per-branch Tomcat ranges (fixed in 9.0.31 / 8.5.51 / 7.0.100 / 6.0.53 - boundary tests prove 9.0.30 fires and 9.0.31 does not)
• CVE-2019-11043 (PHP) widened to its real affected range with the "certain configurations" caveat stated

Docs

• examples/openapi.yaml proves YAML spec loading end to end

Boundary tests: 2.4.48 (below) and 2.4.51 (above) do NOT match; 2.4.49 and 2.4.50 do. 68 tests, evidence 21/21. CI green.

summit v0.6.2 - time-based SQLi, GraphQL introspection, expanded mining

Two new detection families and two expanded surfaces:

• time-based blind SQL injection (CWE-89): MySQL/PostgreSQL/MSSQL delay payloads, baseline measured twice, every probe repeated, all probes must exceed the calibrated threshold. Always potential - network jitter can fake a delay and we say so. Measured on the demo: baseline 0.005s -> probes 0.25s, detected with a 0.2s threshold.
• GraphQL introspection (CWE-200): common paths probed with a minimal __schema query (POST first, GET fallback); confirmed only when a real schema payload comes back. Measured: POST /graphql -> HTTP 200 with __schema.
• param miner expanded: ~120 candidate parameter names from bug-bounty writeups and framework source.
• sensitive paths expanded: /.git/HEAD and /.aws/credentials join the content-signature checks.

The concurrency evidence claim is now best-of-3 on each side - CI runners share CPUs and one noisy run must not fail a valid claim.

64 tests, evidence 21/21. CI green.

summit v0.6.1 - false-positive extermination, complete evidence

False-positive extermination pass. Three changes, each with a regression test:

• authorize guard: if the "privileged" response is itself a redirect or a content-less shell, both roles are bouncing off the same auth wall - no longer reported as broken access control. Regression test: a login wall that 302s every role is suppressed; a real admin panel is still flagged.
• SSTI guard: a page that echoes {{7*7}} literally while containing "49" elsewhere (a page number, a price) is reflection, not evaluation. The raw template must disappear for a finding. Regression test included.
• Complete evidence: finding evidence is no longer truncated anywhere - as_dict and the console report ship the full proof string. The "evidence not truncated" behavior itself has a test.

64 tests, evidence 19/19. CI green.

summit v0.6.0 - command injection, SSTI, CRLF, sensitive files, CWE/CVE tagging

Sixth release. Four new check families and - the headline - every finding in every report now carries its CWE (and CVE where a version banner matches the offline database).

New in v0.6.0

OS command injection (CWE-78)

Echo-based probes across seven shell separators, with an anti-false-positive control probe: the exec marker must appear MORE often than the control marker. A server that merely reflects input shows both markers equally and is suppressed. Measured on the demo: exec x2 vs control x1 -> confirmed. No time-based sleep payloads, ever.

Server-side template injection (CWE-1336, RCE class)

{{7*7}}, ${7*7}, <%= 7*7 %>, {7*7} - confirmed only when 49 comes back and is absent from the baseline. Measured: Jinja2 canary -> 49, confirmed.

CRLF injection (CWE-113)

An injected header must materialize in the response. Measured: X-Summit-CRLF: injected, confirmed.

Sensitive file exposure (CWE-538)

.env, .git/config, database dumps, config backups - confirmed by content signature, never by status code alone (wildcard-routing servers make status-code checks useless). Runs once per scan against the origin.

CWE/CVE tagging

Every finding now carries its CWE (central map, 30+ check ids) and version banners are matched against an offline curated CVE database (Apache 2.4.49/50, nginx 1.20.0, OpenSSH 7.2, PHP 7.4.0, Tomcat 9). CVE findings stay potential - banners are trivially spoofed. Console, JSON and HTML reports all include the references.

Verified

• 60 tests, ruff clean
• evidence runner: 19/19 claims (16 seeded check families, zero false positives, each new check shown with its own evidence)
• demo app grew to sixteen seeded issue classes

Install

git clone https://github.com/pennacle-security/summit.git && cd summit && pip install -e .

Python 3.10+, requests is the only dependency.

Authorized testing only.

summit v0.5.0 - authorization testing, hidden parameter mining, OpenAPI scanning

Fifth release. Three additions that used to live behind paid tooling - now free, scripted, and verified like everything else here.

New in v0.5.0

Broken access control testing (summit authorize)

The Autorize workflow: request each URL as a privileged role and as a low-privilege role, compare responses. Verdicts: enforced / broken (critical, confirmed) / partial (potential). Measured on the demo admin panel: served salaries to both roles, caught as confirmed.

Hidden parameter mining (summit mine)

The Param Miner approach: ~70 undocumented parameter names probed with unique markers. Reflection findings are confirmed; behavior changes are potential. Measured: the demo app's hidden debug switch found as confirmed, the other candidates silent - zero noise.

OpenAPI-driven scanning

summit scan --openapi spec.json turns a JSON OpenAPI document into scan targets - path params filled from examples and defaults, no crawling. Measured: the spec alone leads the engine to the seeded SQL injection and XSS.

Verified

• 53 tests, ruff clean
• evidence runner: 14/14 claims (three new: authorize, mining, openapi)
• CI runs pytest + smoke test + evidence on every push

Install

git clone https://github.com/pennacle-security/summit.git && cd summit && pip install -e .

Python 3.10+, requests is the only dependency.

Authorized testing only.

summit v0.4.1 - quality gates, community, docs

Tooling and community release. No scanner behavior changed - the detection engine is untouched since v0.4.0.

Quality gates (all blocking in CI now)

• ruff lint gate (pycodestyle errors/warnings + pyflakes) - zero findings, enforced before tests run
• CodeQL (Python) semantic analysis on every push, PR, and weekly schedule - uploaded to code scanning
• OpenSSF Scorecard weekly + on push; all GitHub Actions pinned to full commit SHAs
• Dependabot watching pip and action dependencies

Community

• first external contributions merged and credited: GoDaddy parked-page signature (@SakarPaisen) and SiteLock WAF fingerprint (@mrvi0) - both with positive and negative tests
• contributors wall added to the README
• welcome bot greets first-time issues and PRs
• CII Best Practices entry submitted (project #15532)

Docs

• GitHub Pages documentation site: https://pennacle-security.github.io/summit/ (Home, Installation, Usage, Checks, Architecture, Security, Contributing)

Verified

• 45 tests, ruff clean, smoke test green, evidence runner 11/11 - all in CI on every push

Authorized testing only.

summit v0.4.0 - takeover fingerprints, host header injection, CORS reflection

Fourth release. Three new check families, one honest number fixed.

New in v0.4.0

Resource takeover fingerprints (passive)

A 404 that answers with a provider's unclaimed-resource page is a takeover setup. Summit now fingerprints AWS S3 (NoSuchBucket), GitHub Pages, Heroku, Azure, Shopify, Fastly, Pantheon, Tumblr, Surge and Bitbucket, reporting confirmed findings with the reclaim instruction. Fingerprint-only by design: no DNS tricks, no active claiming, ever.

Host header injection (active)

The probe sets a marker domain as the Host header and reports only when it comes back - and only when it is absent from the baseline. Measured on the demo target: reflected into a password-reset link, confirmed.

CORS origin reflection (active)

The active probe sends Origin: https://summit-cors-probe.example and reports when the server reflects it into Access-Control-Allow-Origin with credentials allowed. Measured: reflected, confirmed.

Stability

• the engine's finding dedupe is now explicitly locked instead of relying on GIL luck
• the concurrency claim was measured on loopback before (a misleading 1.1x) - it is now measured against a latency-bearing target (25 ms per request, like a real server): serial 1.46s -> parallel 0.18s, 8.1x speedup, asserted in CI
• Host headers from repeater files are now honored instead of silently stripped

Verified

• 45 tests, pytest -q
• evidence runner: 11/11 claims PASS (12 seeded check families, zero false positives, takeover/host-header/CORS each shown with its own evidence)
• CI runs pytest + the smoke test + the evidence runner on every push

Install

git clone https://github.com/pennacle-security/summit.git && cd summit && pip install -e .

Python 3.10+, requests is the only dependency.

Authorized testing only.

summit v0.3.0 - WAF analysis, rate limiting, recon orchestration, evidence runner

Third release. The headline: nothing on our README is a promise anymore - it is a measured claim. A new evidence runner (examples/evidence.py) reproduces every feature live and runs in CI on every push.

New in v0.3.0

WAF detection and bypass

• fingerprints Cloudflare, AWS WAF, Akamai, Imperva, ModSecurity, Sucuri, F5, Wordfence (tight signatures only)
• when a filter blocks payloads, tamper variants (single/double URL-encoding, comment splitting, case alternation) are tried
• a bypass is reported only when the original payload lands decoded in the response - measured: raw -> HTTP 403, encoded -> HTTP 200 with the payload decoded

CAPTCHA: detect, do not solve

reCAPTCHA / hCaptcha / Turnstile / challenge pages are detected and reported. Summit does not solve CAPTCHAs - that line does not move.

Rate limiting, timeouts, retries

• --rate 5: hard 5 rps ceiling across all threads (measured: 12 requests -> 2.20s vs 0.02s unlimited)
• --timeout, --retries: 429/503 retries honoring Retry-After, budget proven by a live test that counts the hits

Smart probe prioritization

A transparent scoring model orders known-injectable parameters first (deterministic, auditable - we will not call it a neural network). Scan output shows: smart order: N high-signal injection point(s) probed first.

Recon orchestration

summit recon target chains subfinder -> httpx -> nmap with defensive parsing, caps against passive-DNS noise, and honest failure notes (a crashed nmap is reported as failed, never as "no open ports"). --install-tools installs what is missing.

Toolkit + updates

• summit decode -f jwt ... (honest "signature NOT verified" note), b64/url/hex encode & decode
• --check-update / --auto-update: numeric version comparison against GitHub releases
• --install-tools: best-effort installer for the recon integrations

Verified

• 37 tests, pytest -q
• evidence runner: 8/8 claims PASS (9 seeded check families, zero false positives on the control link, WAF bypass at the HTTP level, rate limiter pacing measured, concurrency best-of-3)
• CI now runs the evidence runner on every push

Install

git clone https://github.com/pennacle-security/summit.git && cd summit && pip install -e .

Python 3.10+, requests is the only dependency.

Authorized testing only.