v3.8-stable
- Fixed: Multiple bug-fixes regarding several reported unhandled exceptions.
- Revised: Minor improvement regarding parsing raw HTTP request from a file (i.e.
-r
option). - Revised: Minor improvement regarding dynamic code evaluation technique (i.e. command execution output).
- Added: Translation for README.md in Farsi(Persian) (via @verfosec)
- Fixed: Minor bug-fix regarding
--skip-empty
flag, for skipping the testing of the parameter(s) with empty value(s). - Revised: Minor improvement regarding tamper script "uninitializedvariable.py", for adding randomly generated uninitialized bash variables between the characters of each command of the generated payloads.
- Revised: Minor improvement regarding skipping further tests involving target that an injection point has already been detected.
- Revised: Minor code refactoring regarding multiple tamper scripts (i.e. "backslashes.py", "dollaratsigns.py", "doublequotes.py", "singlequotes.py", "uninitializedvariable.py").
- Added: New tamper script "rev.py" that reverses (characterwise) the user-supplied operating system commands.
- Fixed: Minor bug-fix regarding checking for similarity in provided parameter(s) name(s) and value(s).
- Fixed: Minor bug-fix regarding forcing usage of SSL/HTTPS requests toward the target (i.e.
--force-ssl
flag). - Fixed: Minor bug-fix regarding setting custom output directory path (i.e.
--output-dir
option). - Added: Support for
Bearer
HTTP authentication type. - Revised: Minor improvement regarding tamper script "xforwardedfor.py" (that appends a fake HTTP header
X-Forwarded-For
). - Fixed: Minor bug-fix regarding not ignoring specified injection technique(s) when
--ignore-session
or--flush-session
options are set. - Replaced: The
--dependencies
option has been replaced with--ignore-dependencies
, regarding ignoring all required third-party library dependencies. - Added: New option
--alert
to run host OS command(s) when injection point is found.
Note: For more check the detailed changeset.