Skip to content

summit v0.3.0 - WAF analysis, rate limiting, recon orchestration, evidence runner

Choose a tag to compare

View all tags
@incr3d1ble incr3d1ble released this 15 Oct 10:25
· 45 commits to main since this release
v0.3.0
048b81d

Third release. The headline: nothing on our README is a promise anymore - it is a measured claim. A new evidence runner (examples/evidence.py) reproduces every feature live and runs in CI on every push.

New in v0.3.0

WAF detection and bypass

  • fingerprints Cloudflare, AWS WAF, Akamai, Imperva, ModSecurity, Sucuri, F5, Wordfence (tight signatures only)
  • when a filter blocks payloads, tamper variants (single/double URL-encoding, comment splitting, case alternation) are tried
  • a bypass is reported only when the original payload lands decoded in the response - measured: raw -> HTTP 403, encoded -> HTTP 200 with the payload decoded

CAPTCHA: detect, do not solve

reCAPTCHA / hCaptcha / Turnstile / challenge pages are detected and reported. Summit does not solve CAPTCHAs - that line does not move.

Rate limiting, timeouts, retries

  • --rate 5: hard 5 rps ceiling across all threads (measured: 12 requests -> 2.20s vs 0.02s unlimited)
  • --timeout, --retries: 429/503 retries honoring Retry-After, budget proven by a live test that counts the hits

Smart probe prioritization

A transparent scoring model orders known-injectable parameters first (deterministic, auditable - we will not call it a neural network). Scan output shows: smart order: N high-signal injection point(s) probed first.

Recon orchestration

summit recon target chains subfinder -> httpx -> nmap with defensive parsing, caps against passive-DNS noise, and honest failure notes (a crashed nmap is reported as failed, never as "no open ports"). --install-tools installs what is missing.

Toolkit + updates

  • summit decode -f jwt ... (honest "signature NOT verified" note), b64/url/hex encode & decode
  • --check-update / --auto-update: numeric version comparison against GitHub releases
  • --install-tools: best-effort installer for the recon integrations

Verified

  • 37 tests, pytest -q
  • evidence runner: 8/8 claims PASS (9 seeded check families, zero false positives on the control link, WAF bypass at the HTTP level, rate limiter pacing measured, concurrency best-of-3)
  • CI now runs the evidence runner on every push

Install

git clone https://github.com/pennacle-security/summit.git && cd summit && pip install -e .

Python 3.10+, requests is the only dependency.

Authorized testing only.

Assets 2
Loading