v1.1.0
Framework discovery and distributed scan reliability
Discover more routes and assets from modern application manifests, bring local wordlists to distributed scans, and recover scan context when reconnecting.
Added5
- Route and asset discovery from Next.js Pages Router, Nuxt 3, Create React App, Vite, Laravel Vite, Laravel Mix, and Workbox manifests, with the source framework recorded for each result.
- Local wordlist uploads from the distributed TUI, including tiered wordlists. Files are read from the TUI machine and uploaded before the scan starts.
- Recovery of saved finding summaries when attaching or reconnecting to a distributed scan, with a warning when the available history is incomplete.
- Initial connection diagnostics in the terminal and TUI, including guidance for TLS failures and structured failure details in JSON output.
- Extension lists loaded from a file with -x @extensions.txt, alongside extensions supplied directly on the command line.
Changed3
- The --limit-rate option now also applies to connection checks, wildcard probes, similarity checks, and resource extraction. Limits remain per scan agent.
- Framework manifests can now contribute discovered paths even when their responses are filtered. Scope checks and extraction settings still apply, and the manifest response remains filtered.
- Distributed scans without an explicit wordlist now use the controller default. The wordlist setting is read-only in the TUI.
Fixed10
- Offline activation failures when the standalone or controller executable was renamed.
- Missing TUI metrics when joining an existing distributed scan. Dashboard metrics now populate from controller status snapshots.
- Distributed scan sessions sharing wordlist, recursion, or work assignment state that should remain isolated.
- Stale agent disconnects removing newer connections, and healthy long-running scans losing their work assignments.
- Late distributed updates restarting finished work. Cancellation still accepts final updates needed for a clean shutdown.
- Incorrect extension suffixes in scans and wildcard probes, including compound extensions and paths with trailing slashes.
- Generated suffixes being fed back into discovery when extensions are shared between targets.
- Query parameter and cookie values containing additional equals signs being rejected or parsed incorrectly.
- The missing --url alias and incorrect help text for extraction presets and subcommands.
- Large bursts of standalone findings filling distributed message tracking capacity.