TigahandGitHub 9c241cf185 fix(scan): key joomla detection on the generator tag (#173) ...

detectJoomla matched any body containing the lowercase word "joomla", so pages
that merely mention it (joomla hosting marketing like hostinger.com) were
misreported as Joomla. the canonical Joomla! generator tag is capitalised, so
the lowercase match also missed sites whose only tell is that tag.

match the Joomla! generator meta tag and the joomla asset paths
(/media/vendor/joomla, /media/system/js/core.js) instead. keying on the meta
attribute rather than the plain tagline also rejects prose that quotes it.

2026-06-22 16:47:58 -07:00

..

builtin

refactor: dedupe url scheme stripping

2026-06-09 13:51:04 -07:00

frameworks

fix(frameworks): stop ghost detector matching the generic ghost-button (#163)

2026-06-22 16:47:43 -07:00

js

perf(scan): drain response bodies so pooled connections get reused

2026-06-10 15:50:58 -07:00

cloudstorage.go

perf(scan): drain response bodies so pooled connections get reused

2026-06-10 15:50:58 -07:00

cms_joomla_test.go

fix(scan): key joomla detection on the generator tag (#173)

2026-06-22 16:47:58 -07:00

cms.go

fix(scan): key joomla detection on the generator tag (#173)

2026-06-22 16:47:58 -07:00

cors_test.go

feat(scan): add cors, open-redirect and reflected-xss probes

2026-06-09 18:11:38 -07:00

cors.go

perf(scan): drain response bodies so pooled connections get reused

2026-06-10 15:50:58 -07:00

crawl_test.go

feat(scan): add web crawler and passive subdomain/url discovery

2026-06-09 18:11:38 -07:00

crawl.go

feat(scan): add web crawler and passive subdomain/url discovery

2026-06-09 18:11:38 -07:00

dirlist_test.go

feat(dirlist): response filters, wildcard calibration and custom wordlists

2026-06-10 14:47:17 -07:00

dirlist.go

perf(scan): work-stealing worker pool replacing static stride partition

2026-06-10 16:39:04 -07:00

dnslist_test.go

fix(scan): dnslist dedup, robots recursion bound, framework version lookup, takeover cname

2026-06-10 14:47:17 -07:00

dnslist.go

perf(scan): work-stealing worker pool replacing static stride partition

2026-06-10 16:39:04 -07:00

dork.go

perf(scan): work-stealing worker pool replacing static stride partition

2026-06-10 16:39:04 -07:00

favicon_test.go

feat(scan): add jwt, openapi and favicon-hash scanners

2026-06-10 15:50:59 -07:00

favicon.go

fix(favicon): use twmb/murmur3; spaolacci does checkptr-unsafe pointer math that crashes under -race (which CI runs)

2026-06-10 16:08:47 -07:00

fuzz_test.go

chore: bump copyright headers to 2026

2026-06-08 18:30:48 -07:00

git.go

perf(scan): work-stealing worker pool replacing static stride partition

2026-06-10 16:39:04 -07:00

headers.go

perf(scan): drain response bodies so pooled connections get reused

2026-06-10 15:50:58 -07:00

integration_test.go

feat(dnslist): async dns resolution with wildcard filtering

2026-06-10 15:30:03 -07:00

jwt_test.go

feat(scan): add jwt, openapi and favicon-hash scanners

2026-06-10 15:50:59 -07:00

jwt.go

feat(scan): add jwt, openapi and favicon-hash scanners

2026-06-10 15:50:59 -07:00

lfi_test.go

chore: bump copyright headers to 2026

2026-06-08 18:30:48 -07:00

lfi.go

feat: shared http client with proxy, custom headers and rate limiting

2026-06-09 17:28:14 -07:00

nuclei.go

refactor: dedupe url scheme stripping

2026-06-09 13:51:04 -07:00

openapi_test.go

feat(scan): add jwt, openapi and favicon-hash scanners

2026-06-10 15:50:59 -07:00

openapi.go

feat(scan): add jwt, openapi and favicon-hash scanners

2026-06-10 15:50:59 -07:00

passive_test.go

feat(scan): add web crawler and passive subdomain/url discovery

2026-06-09 18:11:38 -07:00

passive.go

perf(scan): drain response bodies so pooled connections get reused

2026-06-10 15:50:58 -07:00

ports.go

perf(scan): work-stealing worker pool replacing static stride partition

2026-06-10 16:39:04 -07:00

probe_test.go

feat: live-host probe and sarif/markdown report export

2026-06-10 14:47:17 -07:00

probe.go

feat: live-host probe and sarif/markdown report export

2026-06-10 14:47:17 -07:00

redirect_test.go

fix(scan): detect open redirects through scheme-malformed payloads (#172)

2026-06-22 16:47:52 -07:00

redirect.go

fix(scan): detect open redirects through scheme-malformed payloads (#172)

2026-06-22 16:47:52 -07:00

result.go

chore: drop decorative emoji and redundant comments

2026-06-08 18:53:06 -07:00

scan_test.go

fix(scan): dnslist dedup, robots recursion bound, framework version lookup, takeover cname

2026-06-10 14:47:17 -07:00

scan.go

perf(scan): work-stealing worker pool replacing static stride partition

2026-06-10 16:39:04 -07:00

securityheaders_test.go

feat: add security header analysis scan

2026-06-08 18:53:06 -07:00

securityheaders.go

perf(scan): drain response bodies so pooled connections get reused

2026-06-10 15:50:58 -07:00

securitytrails_test.go

feat: add securitytrails integration for domain discovery + target expansion

2026-02-17 13:38:07 +01:00

securitytrails.go

perf(scan): drain response bodies so pooled connections get reused

2026-06-10 15:50:58 -07:00

shodan_test.go

chore: bump copyright headers to 2026

2026-06-08 18:30:48 -07:00

shodan.go

perf(scan): drain response bodies so pooled connections get reused

2026-06-10 15:50:58 -07:00

sql_test.go

chore: bump copyright headers to 2026

2026-06-08 18:30:48 -07:00

sql.go

perf(scan): drain response bodies so pooled connections get reused

2026-06-10 15:50:58 -07:00

subdomaintakeover.go

perf(scan): work-stealing worker pool replacing static stride partition

2026-06-10 16:39:04 -07:00

whois.go

refactor: dedupe url scheme stripping

2026-06-09 13:51:04 -07:00

xss_test.go

feat(scan): add cors, open-redirect and reflected-xss probes

2026-06-09 18:11:38 -07:00

xss.go

feat(scan): add cors, open-redirect and reflected-xss probes

2026-06-09 18:11:38 -07:00