summit v0.9.0 - phase-based engine, tech fingerprinting

Major release. The engine is now phase-based - each scan runs through sequential phases that mirror how a human pentester works.

Phase-based scanning engine

The engine now runs in sequential phases, each building on the previous:

Phase 1: RECON        - crawl, map attack surface, collect links/forms/JS endpoints
Phase 2: FINGERPRINT  - identify server, CMS, framework, libraries (Wappalyzer approach)
Phase 3: VULNERABILITY - passive + active checks, prioritized by detected technology

Each phase produces structured output consumed by the next. You always know what ran, in what order, and what it found.

Wappalyzer-style technology fingerprinting

New summit/fingerprint.py with 35+ fingerprints across 7 categories:

• Servers: Nginx, Apache, IIS, LiteSpeed, Caddy, Cloudflare
• CMS: WordPress, Drupal, Joomla, Ghost, Shopify, Wix, Squarespace, Webflow
• Frameworks: Django, Flask, Express, Spring, Laravel, Next.js, Nuxt, React, Vue, Angular, Gatsby, FastAPI, Gunicorn
• Languages: PHP, Python, Node.js, Java, ASP.NET, Ruby, Go
• Libraries: jQuery, Bootstrap, Lodash
• Analytics: Google Analytics, Hotjar, Meta Pixel
• CDNs: Cloudflare, CloudFront, Fastly, Akamai, KeyCDN

Tech-aware smart model v2

The prioritizer now reads detected technologies and boosts parameters relevant to that stack. PHP detected -> traversal and command injection parameters boosted. Python detected -> SSTI and NoSQL boosted. Deterministic, auditable, not a "neural network".

Modern CVE database

Added entries for WordPress 6.x (CVE-2022-35914), PHP 8.x (CVE-2022-31626), nginx 1.23 (CVE-2023-44487), Jetty 9.4 (CVE-2023-44487). All with proper version ranges via packaging.

88 tests, ruff clean, evidence 22/22. CI green on all workflows.