Skip to content

v3.8-stable

Compare
Choose a tag to compare
@stasinopoulos stasinopoulos released this 14 Aug 08:46
· 194 commits to master since this release
  • Fixed: Multiple bug-fixes regarding several reported unhandled exceptions.
  • Revised: Minor improvement regarding parsing raw HTTP request from a file (i.e. -r option).
  • Revised: Minor improvement regarding dynamic code evaluation technique (i.e. command execution output).
  • Added: Translation for README.md in Farsi(Persian) (via @verfosec)
  • Fixed: Minor bug-fix regarding --skip-empty flag, for skipping the testing of the parameter(s) with empty value(s).
  • Revised: Minor improvement regarding tamper script "uninitializedvariable.py", for adding randomly generated uninitialized bash variables between the characters of each command of the generated payloads.
  • Revised: Minor improvement regarding skipping further tests involving target that an injection point has already been detected.
  • Revised: Minor code refactoring regarding multiple tamper scripts (i.e. "backslashes.py", "dollaratsigns.py", "doublequotes.py", "singlequotes.py", "uninitializedvariable.py").
  • Added: New tamper script "rev.py" that reverses (characterwise) the user-supplied operating system commands.
  • Fixed: Minor bug-fix regarding checking for similarity in provided parameter(s) name(s) and value(s).
  • Fixed: Minor bug-fix regarding forcing usage of SSL/HTTPS requests toward the target (i.e. --force-ssl flag).
  • Fixed: Minor bug-fix regarding setting custom output directory path (i.e. --output-dir option).
  • Added: Support for Bearer HTTP authentication type.
  • Revised: Minor improvement regarding tamper script "xforwardedfor.py" (that appends a fake HTTP header X-Forwarded-For).
  • Fixed: Minor bug-fix regarding not ignoring specified injection technique(s) when --ignore-session or --flush-session options are set.
  • Replaced: The --dependencies option has been replaced with --ignore-dependencies, regarding ignoring all required third-party library dependencies.
  • Added: New option --alert to run host OS command(s) when injection point is found.

Note: For more check the detailed changeset.