ViperClaw v2.0.0 — BrowserOS Bridge, Barrier Race, JWT, GraphQL & OOB Engines (14 Skills + 13 MCP Tools)

🐍 ViperClaw v2.0.0 — The Apex Zero-Dependency Offensive Upgrade

✨ New Pure-Python 3.10+ Offensive Engines (src/viperclaw/analyzers/)

1. ⚡ Barrier-Synchronized Race Condition Engine (race_engine.py / viperclaw race / viper_race_burst): Pre-connected http.client socket pool synchronized via threading.Barrier for sub-millisecond TOCTOU bursts.
2. 🔑 JWT Cracker, Forger & Live Replay Engine (jwt_engine.py / viperclaw jwt / viper_jwt_attack): High-speed HMAC secret cracker + automated token forgery (alg:none, kid /dev/null & SQLi, RS256→HS256 key confusion) + live HTTP replay verification.
3. 🔮 GraphQL Introspection, Clairvoyance & Batching Engine (graphql_engine.py / viperclaw graphql / viper_graphql_scan): Introspection WAF bypasses, Apollo/GraphQL-js Did you mean...? schema harvesting, JSON array batching, and alias amplification.
4. 📡 Out-of-Band (OOB) Canary & Callback Listener (oob_engine.py / viperclaw oob / viper_oob_probe): HMAC-authenticated canary tokens across 6 blind bug classes + ephemeral stdlib HTTP listener.
5. 🌐 BrowserOS Neo Telemetry Bridge (browser_bridge.py / viperclaw browser / viper_browser_ingest): Runtime fetch/XHR hooks and DOM/storage/JWT ingestion from signed-in BrowserOS tabs.

🎯 2 New Offensive Playbooks (14 Total in skills/)

• viper-browseros-agent: Live signed-in BrowserOS Neo session bridge, request-signer replay & DOM XSS verification.
• viper-waf-evasion-framing: Scientific verification framing, 5-rung WAF parser-differential ladder & target AI/LLM guardrail auditing.

ViperClaw v1.2.0 — Comprehensive User Guide, 4-Layer Architecture SVG & Mobile-Responsive Docs

What's New in ViperClaw v1.2.0

• Comprehensive Beginner-to-Pro User Guide (docs/README.md): Step-by-step walkthrough covering installation, every CLI command (scan, taint, harvest-js, fingerprint, graph, verify), copy-paste AI agent prompts, 4 end-to-end hunting playbooks, and the 7-Question Triage Gate.
• 4-Layer Vector Architecture Diagram (assets/architecture.svg) & Redesigned README: Bento Grid subsystem overview, scannable tables, and updated 🚀 Quickstart section.
• Mobile-Responsive GitHub Pages Site (https://zahidoverflow.github.io/viperclaw/): Native mobile hero, 4-layer architecture stack, and stacked mobile card tables.

ViperClaw v1.1.0 — Live Stateful Web Exploiter, Multi-Hop Taint SAST & 100% DVWA Benchmark

ViperClaw v1.1.0

🚀 New in v1.1.0

• ⚡ Stateful Live Web Scanner & Wire-Check Exploiter (viperclaw scan <url> & MCP tool viper_live_scan):
  • Stateful cookie jar deduplication, automatic anti-CSRF token extraction (user_token, csrf_token, _token), and automatic lab database initialization/authentication.
  • 10/10 Live Wire-Verified Exploits on DVWA: OS Command Injection (CWE-78), UNION SQLi (CWE-89), Boolean Differential Blind SQLi (CWE-89), SQLi Auth Bypass (LIMIT 1#), Local File Inclusion (CWE-98), Multipart Unrestricted PHP Upload -> RCE (CWE-434), Reflected XSS (CWE-79), Stored XSS (CWE-79), Predictable Sequential Session IDs (CWE-330), and CSRF Password Reset Takeover (CWE-352).
• 🔬 Forward Multi-Hop Transitive Taint SAST & Sanitizer De-Tainting (viperclaw taint):
  • Tracks multi-hop variable assignments ($_GET -> $id -> $query -> mysqli_query) across Python, TS/JS, Go, and PHP.
  • Eliminates false positives on hardened targets via context-aware sanitizer and block-guard detection (PDO::prepare, intval, is_numeric, in_array allowlists, htmlspecialchars, checkToken).
  • Achieves 19 / 19 (100%) DVWA vulnerability module coverage with 0 false positives on impossible.php SQLi/RCE/LFI/XSS files.

🐍 ViperClaw v1.0.0 — Universal AI Offensive Security Harness, Swarm Graph & Proof Oracle

🐍 ViperClaw v1.0.0 (Initial Public Release)

ViperClaw is a 100% clean-room, zero-dependency AI Offensive Security Harness, Stigmergic Attack Surface Knowledge Graph, Wire-Check Proof Oracle, Phase-Gated MCP Server, and 12-Skill Suite built for Google Antigravity, Claude Code, OpenAI Codex, and Cursor.

✨ Highlights

• 🕸️ Stigmergic SQLite Attack Surface Graph (viperclaw.core.graph): Pheromone-weighted lead prioritization with live Mermaid flowchart & JSON export.
• 🧩 Deep JS & Lazy-Chunk Harvester (viperclaw harvest-js): Reconstructs hidden Webpack, Vite, and Next.js lazy chunk manifests and extracts API routes, IDOR/SSRF candidates, GraphQL operations, DOM sinks, and secrets.
• 🔬 Multi-Language Source-to-Sink Taint SAST (viperclaw taint): AST + structural taint analysis across Python, TypeScript/JS, Go, and PHP.
• 🕵️ Proxy & HAR Stack Fingerprinter (viperclaw fingerprint): Infers backend frameworks (FastAPI, NestJS, Spring Boot, Laravel, GraphQL) and sibling API hosts from Caido/Burp HAR captures.
• 🛡️ Wire-Check Proof Oracle & 7-Gate Triage Judge (viperclaw verify): Filters Soft-200 WAF blocks (Cloudflare/Akamai/CloudFront), computes BOLA JSON diffs, scores CVSS v3.1, and exports HackerOne/Bugcrowd Markdown + SARIF 2.1.0.
• 🔌 Phase-Gated stdio MCP Server (viperclaw mcp): 7 token-efficient JSON-RPC tools over stdio.
• 🎯 12 Cross-Harness Methodology Skills (skills/*): One-command installer (viperclaw skills install --target all) + native Claude Code Plugin Marketplace support.