Repository navigation
summit v0.8.5 - all premium features complete
Final release of the 0.8.x line. All premium feature equivalents from Burp Suite and ZAP are now free in summit.
The complete 0.8.x line
| Version | What landed |
|---|---|
| v0.8.0 | Impact-first reporting, grand release |
| v0.8.1 | Stable: PyPI badge, binary links, demo visual update |
| v0.8.2 | NoSQL injection, LDAP injection, format string, HPP, CNAME takeover |
| v0.8.3 | JWT security (alg:none + HMAC), session fixation detection |
| v0.8.4 | Tech-aware smart model v2, modern CVE database |
| v0.8.5 | This release - stability confirmed, docs complete |
50+ checks across 12 families
- Scanner: SQLi (error/boolean/time), XSS, command injection, SSTI, CRLF, LDAP, NoSQL, format string, path traversal, open redirect
- Authorization: BOLA/IDOR (Autorize workflow), JWT security (alg:none, HMAC), session fixation
- Discovery: hidden parameter mining (~120), JS endpoint extraction (AJAX spider), OpenAPI scanning
- Infrastructure: WAF fingerprinting + bypass, TLS certificate audit, sensitive files, takeover (passive + CNAME), directory listing
- Intelligence: email enumeration, cacheable sensitive, CSRF check, security headers grade, CORS analysis
- Link health: broken-link hijacking, dead domains, parked domains, private-target guard
Every finding carries
- Confidence label (confirmed = observed fact, potential = heuristic)
- CWE identifier (40+ mapped)
- CVE reference (when version banner or body signature matches)
- Impact statement (what an attacker concretely achieves)
- Remediation string
- Complete evidence (never truncated)
Verified in CI on every push
88 tests, ruff clean, demo-scan smoke test, evidence runner 22/22. 6 workflows all green.
Install
PyPI: pip install summit-scanner
From source: git clone https://github.com/pennacle-security/summit.git && cd summit && pip install -e .
Binary: Download from releases - Linux amd64, Linux ARM64, Windows amd64.
Authorized testing only.