v4.6.20

v4.6.20 — More benchmark challenges (SSRF, SSTI, LFI, command injection)

Added

• Four more benchmark challenge classes. The benchmark harness now covers SSRF (an internal-target fetch returns cloud-metadata-like secrets), SSTI (a {{7*7}} expression evaluates to 49), LFI/path traversal (../../etc/passwd returns passwd-like content), and command injection (a shell metacharacter yields uid=0(root)), on top of reflected XSS, IDOR, open redirect, and error-based SQLi. Each challenge simulates the dangerous outcome rather than performing a real fetch/exec/file-read, so the set stays hermetic and safe while presenting a crisp, detectable signal. xalgorix-bench now measures eight classes.

Binaries: linux/amd64, linux/arm64, darwin/amd64, darwin/arm64 (v4.6.20, stripped).

Full changelog: https://github.com/xalgorix/xalgorix/blob/main/CHANGELOG.md