v2.7.2

What's New in v2.7.2

v2.7.2 supersedes v2.7.1. Published-artifact verification found that -P printed parsed hosts but continued into credential attempts. v2.7.2 restores the documented print-and-exit behavior and is the recommended v2.7 release.

New Feature: Engagement Manifests and Scope Enforcement

• Engagement manifests — YAML manifests now carry engagement identity, authorization references, scope, lockout policy, and evidence defaults
• Allow/deny scope controls — Host and CIDR allowlists plus explicit deny rules are applied before execution
• Scope-aware plans — Rejected targets appear in dry-run output with stable reasons instead of silently entering the worker queue
• Target parsing fixes — Explicit ports survive CIDR expansion, and bracketed IPv6 targets parse correctly

New Feature: Deterministic Dry-Run Planning

• --dry-run — Resolves targets and credentials into deterministic JSON without performing authentication attempts
• --plan-out — Writes the execution plan to a file for review, approval, or CI evidence
• --require-plan-ack — Requires the exact reviewed plan hash before execution proceeds
• Credential-bound acknowledgments — Plan hashes use keyed HMACs over resolved credential contents, generator settings, inline/combo credentials, and SSH bad-key identities; same-sized credential-list substitutions invalidate the plan
• No plaintext plan leakage — Credential bindings are authenticated digests, not raw usernames, passwords, tokens, or private keys
• Fail-closed key requirement — Acknowledged execution requires evidence.hmac_key in the engagement manifest

New Feature: Lockout-Aware Attempt Budgets

• Normalized account identities — Budgets follow service|domain|user across worker pools instead of resetting per goroutine
• Policy controls — lockout_threshold, lockout_window, safe_margin, and positive jitter_percent are supported
• Shared scheduling — Attempts sleep until the observation window clears rather than exceeding the configured safe budget
• Accurate plans and progress — Planned, queued, TUI, and final totals use the same credential-mode rules

New Feature: Evidence, Proof, and Authenticated Audit

• Evidence modes — full, redacted, hash, and reserved encrypted handling for machine-readable credential output
• Keyed secret correlation — Hash mode emits HMAC-SHA256 correlation values without printing the secret
• Proof metadata — Attempts and findings carry confidence, proof type, and proof detail
• Authenticated audit chains — Audit events are chained with HMAC-SHA256 instead of a recomputable plain hash
• Fail-closed verification — brutespray audit verify requires BRUTESPRAY_AUDIT_HMAC_KEY; missing or incorrect keys fail verification
• Sensitive artifact permissions — Checkpoints, session logs, stores, and audit artifacts use owner-only permissions

New Feature: Workspace and Operator Commands

• JSONL workspace store — Durable engagement records provide a stable baseline without requiring CGO or an external database
• Workspace management — New workspace command paths support initialization and inspection of engagement state
• Audit utilities — Audit verification is available as a first-class subcommand
• CI exit policy — CI-oriented execution has defined fail-closed exit behavior for policy and finding outcomes
• Machine-first output — Plans, evidence, proofs, and workspace records remain deterministic and scriptable

New Feature: Safe Auth Templates and Pre-Auth Probes

• Declarative HTTP auth templates — YAML templates describe HTTP/API authentication flows without enabling arbitrary shell execution
• Template validation — Invalid or unsafe template structures fail before network execution
• Pre-auth probe registry — SSH bad-key and RDP reconnaissance paths use a shared probe seam
• Wrapper remains gated — Arbitrary wrapper commands still require explicit --allow-wrapper

Service Metadata and Credential Routing

• Canonical service descriptors — Default ports, aliases, credential modes, routing support, module parameters, stability, and wordlist aliases now come from one registry
• Descriptor-driven help — Module help and parser lookups derive from the same metadata used by dispatch
• Token-aware execution — InfluxDB v2 tokens are attempted once per token, without multiplication across default usernames
• InfluxDB v1 compatibility — -m mode:v1 preserves normal username/password pair generation
• Registry parity tests — Registered protocol modules, descriptors, parser aliases, and wordlist coverage are checked together

TUI and HTTP Authentication Polish

• Findings visibility — The TUI continues to surface pre-auth findings alongside credential results
• HTTP auth behavior — Basic, Digest, NTLM, and automatic detection paths received compatibility and UX fixes
• Credential accounting — Inline credentials and password-only/token services now produce consistent plan, TUI, and runtime totals
• Operator help — Dry-run, engagement, plan acknowledgment, and module metadata options are included in grouped help output

Wordlist Reliability

• Monthly update repair — The automated wordlist refresh workflow was repaired and hardened
• Credential-only validation — Non-credential descriptor content is rejected from generated credential lists
• Password-only routing — Inline and embedded values are preserved correctly for password-only services
• Manifest consistency — Service metadata, aliases, and embedded wordlist resolution remain parity-tested

Repository Star History

• Exact live count badge — The README count is backed by GitHub's stargazers_count
• Rendered history restored — Light, dark, and PNG charts are committed into the repository so README rendering no longer depends on the broken public Star History endpoint
• Automatic refresh — A commit-pinned GitHub Action refreshes the chart daily and when new stars arrive
• No long-lived third-party write token — Refreshes use the short-lived repository Actions token inside GitHub

v2.7.2 Safety Fix: -P Now Exits

• Documented behavior restored — -P prints parsed, scope-filtered hosts and exits
• No runtime side effects — The return occurs before connection-manager, proxy, output, checkpoint, session-log, signal, worker, TUI, or credential-attempt setup
• TUI and legacy parity — The behavior is handled in the shared Execute path rather than the legacy renderer only
• Regression coverage — A subprocess test proves no credential-attempt output occurs after host listing

Security

• Plan acknowledgments bind credential contents with an engagement HMAC key
• SSH bad-key username and PEM identities are included without exposing private-key material
• Audit chains require keyed authentication and reject missing/different keys
• Shareable machine output can redact or HMAC credential material
• Sensitive files remain owner-readable only
• Wrapper execution remains opt-in
• govulncheck and dependency-review gates are clean

Dependency Updates

• golang.org/x/net v0.57.0 → v0.58.0
• golang.org/x/crypto v0.54.0 → v0.55.0
• golang.org/x/text → v0.41.0
• github.com/jlaffaye/ftp v0.2.1 → v0.2.2
• github.com/charmbracelet/x/ansi v0.11.6 → v0.11.8
• github.com/go-ldap/ldap/v3 v3.4.13 → v3.4.14
• github.com/gosnmp/gosnmp v1.43.2 → v1.44.0
• actions/checkout v7.0.0 → v7.0.1
• actions/setup-go v6.5.0 → v7.0.0
• docker/login-action v4.3.0 → v4.6.0
• docker/setup-buildx-action v4.1.0 → v4.3.0
• Additional pinned Docker, metadata, and GoReleaser action updates

CI / Tooling

• The lint workflow now uses the Go version declared by go.mod instead of the moving stable alias
• GitHub Actions remain commit-SHA pinned at the repository workflow boundary
• Unit, race, integration, lint, govulncheck, and dependency-review gates run on release PRs
• GoReleaser cross-platform snapshots and tagged builds cover Linux, macOS, and Windows on amd64, arm64, armv7, and 386 where supported

Upgrade Notes

• Use v2.7.2, not v2.7.1
• --require-plan-ack requires an engagement manifest with evidence.hmac_key
• brutespray audit verify requires BRUTESPRAY_AUDIT_HMAC_KEY
• InfluxDB v2 remains token mode by default; use -m mode:v1 for username/password authentication
• -P is now a strict print-and-exit operation

Release Verification

• go build ./...
• go vet ./...
• golangci-lint run ./... — 0 issues
• go test ./... -count=1 -race -v — 5 packages passed, 3 packages with no tests, 3 intentional skips
• GitHub unit, integration, lint, govulncheck, and dependency-review checks passed
• Independent release and patch reviews reported no remaining blockers
• GoReleaser published nine platform archives plus checksums.txt
• The published macOS arm64 archive matched its release SHA-256 digest
• The extracted published binary reported Brutespray v2.7.2
• Published-binary -P smoke printed the host table and exited without credential attempts

Full Changelog: v2.6.3...v2.7.2