summit v0.4.0 - takeover fingerprints, host header injection, CORS reflection

Fourth release. Three new check families, one honest number fixed.

New in v0.4.0

Resource takeover fingerprints (passive)

A 404 that answers with a provider's unclaimed-resource page is a takeover setup. Summit now fingerprints AWS S3 (NoSuchBucket), GitHub Pages, Heroku, Azure, Shopify, Fastly, Pantheon, Tumblr, Surge and Bitbucket, reporting confirmed findings with the reclaim instruction. Fingerprint-only by design: no DNS tricks, no active claiming, ever.

Host header injection (active)

The probe sets a marker domain as the Host header and reports only when it comes back - and only when it is absent from the baseline. Measured on the demo target: reflected into a password-reset link, confirmed.

CORS origin reflection (active)

The active probe sends Origin: https://summit-cors-probe.example and reports when the server reflects it into Access-Control-Allow-Origin with credentials allowed. Measured: reflected, confirmed.

Stability

• the engine's finding dedupe is now explicitly locked instead of relying on GIL luck
• the concurrency claim was measured on loopback before (a misleading 1.1x) - it is now measured against a latency-bearing target (25 ms per request, like a real server): serial 1.46s -> parallel 0.18s, 8.1x speedup, asserted in CI
• Host headers from repeater files are now honored instead of silently stripped

Verified

• 45 tests, pytest -q
• evidence runner: 11/11 claims PASS (12 seeded check families, zero false positives, takeover/host-header/CORS each shown with its own evidence)
• CI runs pytest + the smoke test + the evidence runner on every push

Install

git clone https://github.com/pennacle-security/summit.git && cd summit && pip install -e .

Python 3.10+, requests is the only dependency.

Authorized testing only.