Skip to content

v1.0.1

Choose a tag to compare

View all tags
@secretsifter secretsifter released this 26 Apr 13:31
· 9 commits to main since this release
v1.0.1
f453a3e

SecretSifter v1.0.1 — bug fixes and refinements over v1.0.0. No new third-party network features; no AI provider integration. Compatible with Burp Suite 2024.7+ (Pro and Community).

Install

  1. Download secretsifter-1.0.1.jar from the Assets section below
  2. Open Burp Suite → Extensions → Installed → Add
  3. Set Extension type to Java, browse to the JAR, click Next
  4. A Secret Sifter tab appears in the main tab bar

Reproducible build verification

This release is built with preserveFileTimestamps = false and reproducibleFileOrder = true. Anyone cloning this repo at tag v1.0.1 and running ./gradlew shadowJar produces a byte-identical JAR.

SHA-256: 450a4a6ddfe5e27b8c41bbc08ff31afba24493c86e2d96e9e6b84b37270ffdb5
Size:    517 KB

What's changed since v1.0.0

New features

  • Custom rules only (raw) mode — new toggle in Settings → Custom Rules. When enabled, the proxy and bulk-scan paths run only user-supplied custom rules and bypass the false-positive filters; every regex match is reported as-is. Built-in scanners are skipped. Allow/blocklist/CDN list still apply.
  • NOISE marking — Severity and Confidence dropdowns now include a NOISE option. Rows marked NOISE are rendered in light gray with dimmed text and excluded from HTML / CSV / ZIP exports.
  • Target Status CSV bundled into report ZIPs — per-target reachability/auth status now included in the All-in-one and Per-Domain ZIP exports.
  • Multi-file import for custom rules — Ctrl/Cmd+click to select multiple .txt files; content is appended, not replaced.
  • Custom rules now run on all scan tiers (FAST, LIGHT, FULL) — previously only on FULL.

Bug fixes

  • Per-occurrence reporting in minified bundles — same key/value at different file offsets (or lines) now produces separate findings instead of collapsing N matches at lineNumber=1 into one row.
  • Multi-target attribution — concurrent multi-target scans now correctly attribute a target's own assets to that target, regardless of which thread fetched the URL first.
  • AES_KEY / AES_IV detection — added case-transition heuristic so 32-char alphanumeric AES keys aren't rejected as identifiers; iv, nonce, salt keys gated by recognised crypto prefixes.
  • Webpack content hash suppression — exactly 16/20-char lowercase hex (matching webpack's [contenthash] format) no longer surfaces as findings.
  • Homogeneity check — repeated-character strings (e.g. AAAAAAAAAAAAAAAA) no longer match anchored token patterns.
  • Session identifier suppression — sessionId, jsessionid, phpsessid, asp.net_sessionid, etc. excluded from findings.
  • PEM private key header-only constants suppressed — bare -----BEGIN RSA PRIVATE KEY----- string literals (no key body) no longer match.
  • Opaque Bearer token suppression — Authorization: Bearer <token> in request headers suppressed unless the token starts with a known vendor prefix (ghp_, sk-, SG., etc.).
  • Structural key suffix filter — keys ending in Type, Error, State, or Kind excluded from generic KV/entropy scanners.
  • JS code-fragment value guard — values containing this., ),, )}, ){ rejected as minified code fragments.
  • Settings tooltip rendering — multi-line HTML tooltip rewritten as plain text (was rendering as literal markup in some Burp/Swing variants).
  • Community rules — 8 noisy patterns tightened — SumoLogic, DroneCI, MessageBird, Netlify, Codecov, OktaApi and others now gated by vendor-prefix or keyword context.

UI

  • Settings panel filter row reorganised into three columns (CDN Blocklist / Key Name Blocklist / Key Name Allowlist), freeing vertical space for the Custom Rules textarea.
Assets 3
Loading