v1.3.0

v1.3.0 - CI gates and template selection

Added

• scan --fail-on SEVERITY exits 1 when a reported finding is at or above the chosen severity. Reports are written before the gate runs.
• scan --baseline previous.json compares against an earlier report with the same dedup key as summit diff; only new or regressed findings count toward the gate. An unreadable baseline exits 2.
• Template selection: --template-tags, --template-exclude-tags and --template-severity.
• summit templates --tags/--exclude-tags/--severity filters the inventory; --json emits machine-readable metadata.

Changed

• The TEMPLATES phase reports templates actually executed after filtering.

This release also includes the v1.2.0 Nuclei-style template engine, 25 bundled templates, XPath/SSI/Log4Shell/Shellshock/blind XXE checks, and the OOB raw JNDI listener. See CHANGELOG.md for the full v1.2.0 notes.

Install: pip install summit-scanner==1.3.0

Binaries for linux-amd64, linux-arm64 and windows-amd64 are attached by the release workflow.

summit v1.1.0

Added

• summit setup - first-run wizard; saves defaults to ~/.summit/config.json.
• summit oob - out-of-band HTTP callback listener; summit scan --oob-listen PORT confirms blind SSRF/XXE with a real callback hit.
• --auto-html writes an HTML report automatically after every scan (into summit-reports/, or the output_dir saved by setup).
• --render scans JavaScript-rendered pages via headless Chromium (optional: pip install playwright).
• CNAME-level subdomain takeover verification: DNS resolution plus unclaimed-service fingerprint, confirmation-only (no claiming).
• New checks: XXE (CWE-611), out-of-band SSRF (CWE-918), DOM XSS candidate (CWE-79), hardcoded secrets in client-side code (CWE-798, values redacted), HTTP parameter pollution (CWE-235), TRACE / risky HTTP methods (CWE-693, CWE-650).

Changed

• Four confidence levels - confirmed, likely, needs-manual, info - and the label now caps severity (likely -> max medium, needs-manual -> max low): heuristic findings can no longer surface as critical.
• Colorized console output and an ASCII banner; respects NO_COLOR, TERM=dumb and --no-color (piped output stays plain).

Fixed

• Redirect handling hardened: environment proxies are ignored (trust_env=False), CRLF-shaped Location values get Connection: close, and link checks no longer crash on malformed URLs.

Full changelog: https://github.com/pennacle-security/summit/blob/main/CHANGELOG.md

summit v1.0.0 - first stable release

First stable release. Summit v1.0.0 ships with 50+ checks across 12 families, a YAML template engine, and pre-built binaries for 3 platforms.

Template engine (Nuclei-equivalence)

YAML templates let anyone write custom checks without Python. The loader enforces:

• confidence-rule field is mandatory for HIGH/CRITICAL templates - without it, the template won't load. This prevents custom templates from reintroducing the false-positive problems the core checks already solved.
• validate command: summit templates validate <file> checks confidence-rule presence, unrendered {{...}} placeholders, and matcher syntax.

12 starter templates shipped

• exposed-env-file, git-config-exposed (content signatures, not just 200)
• spring-actuator-exposed, exposed-docker-api, kubernetes-exposed (critical)
• graphql-introspection-tpl, exposed-source-map (confirmed)
• wordpress-json-user-enum (user enumeration)
• default-admin-panel (needs-manual - verify default credentials)
• exposed-backup-file, cve-2021-41773-apache-path-traversal

Complete feature list (v0.1.0 -> v1.0.0)

50+ checks across 12 families:

• Injection: SQLi (error/boolean/time), XSS, OS command, SSTI, CRLF, NoSQL, LDAP, format string
• Authorization: BOLA/IDOR, JWT (alg:none, HMAC), session fixation
• Discovery: hidden params (~120), JS endpoints, OpenAPI scanning
• Infrastructure: WAF fingerprinting + bypass, TLS audit, sensitive files, takeover (passive + CNAME)
• Intelligence: email enumeration, cacheable sensitive, CSRF, headers grade, CORS
• Link health: broken-link hijacking, dead domains, parked domains, private-target guard

Every finding carries: confidence label, CWE, CVE, impact statement, remediation, poc, verification_steps, complete untruncated evidence

Report formats: Console (colored), JSON, HTML, SARIF 2.1.0, JUnit XML

Engine: Phase-based (RECON -> FINGERPRINT -> VULNERABILITY), tech-aware prioritizer (35+ fingerprints), severity capping by confidence, WAF block detection, URL normalization, negative controls in CI

88 tests, ruff clean, evidence 22/22, CI green on all workflows.

Install

PyPI: pip install summit-scanner
From source: git clone https://github.com/pennacle-security/summit.git && cd summit && pip install -e .
Binary: Download from releases - Linux amd64, Linux ARM64, Windows amd64.

Authorized testing only.

summit v0.9.5 - WAF detection, normalization, colored CLI, scan diffing

Anti-false-positive infrastructure and developer experience improvements.

WAF block detection (summit/waf_block.py)

New module that detects whether a probe response is a WAF/CDN block rather than a real application response. Checks 403/406/429/503 status codes, block-page body patterns, and WAF-specific headers (cf-mitigated, x-sucuri-id, x-iinfo, etc.). When a probe is blocked, vulnerability checks record an INFO note instead of reporting a false positive.

URL normalization (summit/normalize.py)

• Strips fragments, trailing punctuation, and duplicate slashes
• Sorts query params for consistent comparison
• Deduplicates findings by (check_id, host, evidence) with affected_urls[] merging
• Template sanity check: flags unrendered {placeholder} patterns in finding text

Colored CLI (summit/colors.py)

ANSI color codes for severity-tagged output: red for critical, yellow for high, magenta for medium, green for low. Phase names colored. Falls back to plain text when not a TTY.

Scan diffing (summit/diff.py)

summit diff <old.json> <new.json> classifies findings as new/resolved/unchanged/regressed using the dedup key. Useful for CI gating on new findings only.

Finding model (updated)

• confidence levels: confirmed > likely > needs-manual > info
• severity capping: unverified findings capped at LOW, likely findings capped at MEDIUM
• poc field: reproducible curl command
• verification_steps field: human verification procedure
• affected_urls field: deduplicated URLs merged into one finding

ruff clean. CI green on all workflows.

summit v0.9.4 - Finding model overhaul, severity capping

Finding model overhaul. Severity is now derived from confidence plus verified impact.

Finding model changes

• Confidence levels: confirmed (observed fact) > likely (strong signal) > needs-manual (heuristic) > info (informational)
• Severity capping: findings without working proof are automatically capped. A needs-manual finding can never exceed LOW severity. A likely finding can never exceed MEDIUM.
• poc field: every finding carries a reproducible curl command or verification procedure
• verification_steps field: human-readable steps to verify the finding manually
• affected_urls field: all affected URLs for deduplicated findings

Module updates

• csrf.py: confidence changed from potential to likely (CSRF token absence is a strong signal)

Tests

• severity filter tests updated to use confirmed confidence
• CSRF test updated to expect capped severity
• 88 tests, all passing. Ruff clean. Evidence 22/22. CI green.

summit v0.9.3 - CLI polish, silent mode, progress logging

CLI polish release. The banner now looks like a mountain. Progress logging shows where the scan is and how long each phase took.

New in v0.9.3

Mountain banner

The ASCII banner now resembles a mountain peak with the summit highlighted - the visual identity matches the project name.

--silent flag

Suppress all progress/debug output, only show the final findings report. Works on scan, fuzz, and mine commands. Useful for piping to other tools or running in CI where output volume matters.

Progress and timing

Every command now shows:

• which phase is running ([RECON], [SCAN], [DONE])
• how long each phase took
• total elapsed time
• request count and configuration summary
• estimated remaining time for long operations

Security policy update

The security policy (SECURITY.md) now covers the full 50+ check catalog, CWE/CVE tagging, and the impact-first reporting format.

88 tests, ruff clean, evidence 22/22. CI green on all workflows.

summit v0.9.2 - phase engine crash fix, complete CWE/IMPACT coverage

Stability release. The phase-based engine introduced in v0.9.0 was completely broken - it crashed every time it was used. This release fixes that and proves the fix with a comprehensive 12-point functional audit.

Fixed

• PhaseEngine runtime crash: phases.py used from .crawl.spider (single dot) but crawl is at summit/crawl/, not summit/scan/crawl/. Fixed to from ..crawl.spider. This was a silent crash - the phase-based engine existed in the codebase but never actually worked.
• headers-grade empty CWE: changed from empty string (falsy) to CWE-693.
• captcha-challenge empty CWE: changed from empty string to CWE-807.

Functional audit: 12/12 checks verified

Audit	What it verifies	Result
PhaseEngine	produces findings + technologies, 3 phases, durations	102 findings, 5 technologies
Severity filter	no leaks (critical stays critical)	4 critical, 17 high
No duplicates	no (check_id, url, param) duplicates	102 unique
CWE + IMPACT	populated for every finding	100% coverage
No FP	healthy control link stays unreported	zero FP
SARIF/JUnit	roundtrip valid	SARIF 2.1.0 + JUnit XML
Race condition	concurrent testing works	no-race (expected)
TLS audit	graceful error on HTTP-only target	ConnectionError caught
Min-severity	rank-based filtering correct	31 findings >= medium
CWE + IMPACT for all check_ids	every check_id has both	53/53
Evidence not truncated	as_dict and console return full strings	102 findings verified
Smart prioritizer v2	tech-aware scoring works	Python 3.13.2 detected

Coverage

• 88 tests, ruff clean
• 53/53 check_ids have CWE mappings (100%)
• 53/53 check_ids have IMPACT statements (100%)
• 35+ technology fingerprints in the fingerprint database
• 9 products in the CVE database with range matching
• 6 CI workflows all green

Authorized testing only.

summit v0.9.1 - stable, phase integration verified

Stability release. The phase-based engine (introduced in v0.9.0) is now fully integrated and verified.

Fixed

• fingerprint.py ImportError: the module was at summit/ root level but used .. (two-dot) relative imports, causing ImportError: attempted relative import beyond top-level package. Fixed to single-dot imports. This was breaking the phase-based engine.
• 8 missing CWE mappings: hpp (CWE-235), subdomain-takeover (CWE-350), tls-cert-expired/expiring/self-signed (CWE-295), tls-legacy-versions (CWE-326) - every check_id now has its CWE.
• 15 missing IMPACT statements: every check_id now has a concrete impact statement that tells the user what an attacker achieves.
• Version number: __init__.py and pyproject.toml now correctly say 0.9.1.

Phase integration verified

The PhaseEngine now correctly chains:
Phase 1 (RECON) -> Phase 2 (FINGERPRINT) -> Phase 3 (VULNERABILITY)

Each phase produces structured output consumed by the next. phase_summary() reports per-phase duration and errors.

88 tests, ruff clean, evidence 22/22. CI green on all workflows.

summit v0.9.0 - phase-based engine, tech fingerprinting

Major release. The engine is now phase-based - each scan runs through sequential phases that mirror how a human pentester works.

Phase-based scanning engine

The engine now runs in sequential phases, each building on the previous:

Phase 1: RECON        - crawl, map attack surface, collect links/forms/JS endpoints
Phase 2: FINGERPRINT  - identify server, CMS, framework, libraries (Wappalyzer approach)
Phase 3: VULNERABILITY - passive + active checks, prioritized by detected technology

Each phase produces structured output consumed by the next. You always know what ran, in what order, and what it found.

Wappalyzer-style technology fingerprinting

New summit/fingerprint.py with 35+ fingerprints across 7 categories:

• Servers: Nginx, Apache, IIS, LiteSpeed, Caddy, Cloudflare
• CMS: WordPress, Drupal, Joomla, Ghost, Shopify, Wix, Squarespace, Webflow
• Frameworks: Django, Flask, Express, Spring, Laravel, Next.js, Nuxt, React, Vue, Angular, Gatsby, FastAPI, Gunicorn
• Languages: PHP, Python, Node.js, Java, ASP.NET, Ruby, Go
• Libraries: jQuery, Bootstrap, Lodash
• Analytics: Google Analytics, Hotjar, Meta Pixel
• CDNs: Cloudflare, CloudFront, Fastly, Akamai, KeyCDN

Tech-aware smart model v2

The prioritizer now reads detected technologies and boosts parameters relevant to that stack. PHP detected -> traversal and command injection parameters boosted. Python detected -> SSTI and NoSQL boosted. Deterministic, auditable, not a "neural network".

Modern CVE database

Added entries for WordPress 6.x (CVE-2022-35914), PHP 8.x (CVE-2022-31626), nginx 1.23 (CVE-2023-44487), Jetty 9.4 (CVE-2023-44487). All with proper version ranges via packaging.

88 tests, ruff clean, evidence 22/22. CI green on all workflows.

summit v0.8.5 - all premium features complete

Final release of the 0.8.x line. All premium feature equivalents from Burp Suite and ZAP are now free in summit.

The complete 0.8.x line

Version	What landed
v0.8.0	Impact-first reporting, grand release
v0.8.1	Stable: PyPI badge, binary links, demo visual update
v0.8.2	NoSQL injection, LDAP injection, format string, HPP, CNAME takeover
v0.8.3	JWT security (alg:none + HMAC), session fixation detection
v0.8.4	Tech-aware smart model v2, modern CVE database
v0.8.5	This release - stability confirmed, docs complete

50+ checks across 12 families

• Scanner: SQLi (error/boolean/time), XSS, command injection, SSTI, CRLF, LDAP, NoSQL, format string, path traversal, open redirect
• Authorization: BOLA/IDOR (Autorize workflow), JWT security (alg:none, HMAC), session fixation
• Discovery: hidden parameter mining (~120), JS endpoint extraction (AJAX spider), OpenAPI scanning
• Infrastructure: WAF fingerprinting + bypass, TLS certificate audit, sensitive files, takeover (passive + CNAME), directory listing
• Intelligence: email enumeration, cacheable sensitive, CSRF check, security headers grade, CORS analysis
• Link health: broken-link hijacking, dead domains, parked domains, private-target guard

Every finding carries

• Confidence label (confirmed = observed fact, potential = heuristic)
• CWE identifier (40+ mapped)
• CVE reference (when version banner or body signature matches)
• Impact statement (what an attacker concretely achieves)
• Remediation string
• Complete evidence (never truncated)

Verified in CI on every push

88 tests, ruff clean, demo-scan smoke test, evidence runner 22/22. 6 workflows all green.

Install

PyPI: pip install summit-scanner

From source: git clone https://github.com/pennacle-security/summit.git && cd summit && pip install -e .

Binary: Download from releases - Linux amd64, Linux ARM64, Windows amd64.

Authorized testing only.