3 people b805bfbb87 fix(frameworks): stop django source prose from faking detection (#328) ...

the django detector keyed on the import paths django.contrib and
django.core, which appear only in tutorials and settings snippets and
never in a rendered response, so any two of them crossed the threshold
and fingerprinted a docs page as a live django server. replace the
source tokens with real response artifacts: the csrfmiddlewaretoken
hidden field, the csrftoken cookie and the /static/admin/ asset path.

Co-authored-by: vmfunc <vmfunc.lc@gmail.com>

2026-07-22 22:44:53 +00:00

..

builtin

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

frameworks

fix(frameworks): stop django source prose from faking detection (#328)

2026-07-22 22:44:53 +00:00

js

feat(fuzz): add fuzz harnesses for jwt, secrets and yaml parsing (#340)

2026-07-22 22:24:43 +00:00

cloudstorage_test.go

fix(scan): require a real bucket listing body before flagging s3 exposure (#282)

2026-07-22 12:36:29 -07:00

cloudstorage.go

fix(store,logger,scan): concurrency-adjacent races and correctness fixes (#343)

2026-07-22 12:55:08 -07:00

cms_drupal_test.go

fix(scan): detect modern drupal by its headers (#170)

2026-06-22 20:20:36 -07:00

cms_joomla_test.go

fix(scan): key joomla detection on the generator tag (#173)

2026-06-22 16:47:58 -07:00

cms_wordpress_mention_test.go

fix(scan): drop the bare wordpress detection marker (#171)

2026-06-22 17:41:28 -07:00

cms_wordpress_probe_test.go

fix(scan): require a wordpress marker on probed wp paths (#169)

2026-06-22 18:21:19 -07:00

cms.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

cors_test.go

fix(scan): gate cors http-downgrade probe on https targets only (#305)

2026-07-22 12:48:40 -07:00

cors.go

fix(scan): gate cors http-downgrade probe on https targets only (#305)

2026-07-22 12:48:40 -07:00

crawl_budget_test.go

fix(scan): bound crawl breadth with a page budget (#269)

2026-07-22 12:35:18 -07:00

crawl_test.go

fix(crawl): stop redirects escaping crawl scope, cap fanout (#333)

2026-07-22 12:53:41 -07:00

crawl.go

fix(crawl): stop redirects escaping crawl scope, cap fanout (#333)

2026-07-22 12:53:41 -07:00

dirlist_test.go

fix(scan): apply reflected-path tolerance to soft-404 calibration (#180)

2026-06-22 20:26:19 -07:00

dirlist.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

dnslist_test.go

fix(scan): dnslist dedup, robots recursion bound, framework version lookup, takeover cname

2026-06-10 14:47:17 -07:00

dnslist.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

dork_test.go

fix(scan): percent-encode dork queries before search (#327)

2026-07-22 12:53:04 -07:00

dork.go

fix(scan): percent-encode dork queries before search (#327)

2026-07-22 12:53:04 -07:00

favicon_test.go

refactor(fingerprint): make the favicon tech table the single source (#358)

2026-07-22 12:57:09 -07:00

favicon.go

refactor(fingerprint): make the favicon tech table the single source (#358)

2026-07-22 12:57:09 -07:00

fuzz_test.go

chore: bump copyright headers to 2026

2026-06-08 18:30:48 -07:00

git_test.go

fix(scan): validate git exposure responses are real git artifacts (#339)

2026-07-22 12:54:34 -07:00

git.go

fix(scan): validate git exposure responses are real git artifacts (#339)

2026-07-22 12:54:34 -07:00

headers.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

integration_test.go

fix(scan): require a real bucket listing body before flagging s3 exposure (#282)

2026-07-22 12:36:29 -07:00

jwt_fuzz_test.go

feat(fuzz): add fuzz harnesses for jwt, secrets and yaml parsing (#340)

2026-07-22 22:24:43 +00:00

jwt_test.go

fix(scan): accept string-encoded jwt exp claim (#311)

2026-07-22 12:49:50 -07:00

jwt.go

fix(scan): accept string-encoded jwt exp claim (#311)

2026-07-22 12:49:50 -07:00

lfi_test.go

fix(scan): baseline-diff lfi evidence to stop static-content false positives (#303)

2026-07-22 12:48:22 -07:00

lfi.go

fix(scan): baseline-diff lfi evidence to stop static-content false positives (#303)

2026-07-22 12:48:22 -07:00

nuclei.go

style: apply gofmt to source tree (#232)

2026-06-25 18:19:17 -07:00

openapi_fuzz_test.go

feat(fuzz): add fuzz harnesses for jwt, secrets and yaml parsing (#340)

2026-07-22 22:24:43 +00:00

openapi_test.go

fix(scan): tolerate ref path items when parsing openapi specs (#309)

2026-07-22 12:49:31 -07:00

openapi.go

fix(scan): tolerate ref path items when parsing openapi specs (#309)

2026-07-22 12:49:31 -07:00

passive_test.go

fix(scan): fetch wayback source over https (#351)

2026-07-22 21:01:33 +00:00

passive.go

fix(scan): fetch wayback source over https (#351)

2026-07-22 21:01:33 +00:00

ports_test.go

fix(scan): honour the caller context when downloading the ports list (#324)

2026-07-22 12:52:21 -07:00

ports.go

fix(scan): honour the caller context when downloading the ports list (#324)

2026-07-22 12:52:21 -07:00

probe_fuzz_test.go

feat(fuzz): add fuzz harnesses for jwt, secrets and yaml parsing (#340)

2026-07-22 22:24:43 +00:00

probe_test.go

fix(scan): decode html entities in probe title (#354)

2026-07-22 12:56:38 -07:00

probe.go

fix(scan): decode html entities in probe title (#354)

2026-07-22 12:56:38 -07:00

redirect_test.go

fix(scan): strip url whitespace before open-redirect host check (#306)

2026-07-22 12:49:07 -07:00

redirect.go

fix(scan): strip url whitespace before open-redirect host check (#306)

2026-07-22 12:49:07 -07:00

result.go

chore: drop decorative emoji and redundant comments

2026-06-08 18:53:06 -07:00

scan_test.go

fix(scan): report the found url in dork results and dedupe by url (#283)

2026-07-22 12:36:38 -07:00

scan.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

securityheaders_test.go

fix(scan): grade hsts on the final response scheme after redirects (#310)

2026-07-22 12:49:40 -07:00

securityheaders.go

fix(scan): grade hsts on the final response scheme after redirects (#310)

2026-07-22 12:49:40 -07:00

securitytrails_test.go

feat: add securitytrails integration for domain discovery + target expansion

2026-02-17 13:38:07 +01:00

securitytrails.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00

shodan_test.go

fix(scan): truncate shodan banners on rune boundaries (#326)

2026-07-22 12:52:55 -07:00

shodan.go

fix(scan): truncate shodan banners on rune boundaries (#326)

2026-07-22 12:52:55 -07:00

sql_adminpanel_query_test.go

fix(scan): apply reflected-path tolerance to soft-404 calibration (#180)

2026-06-22 20:26:19 -07:00

sql_soft404_test.go

fix(scan): apply reflected-path tolerance to soft-404 calibration (#180)

2026-06-22 20:26:19 -07:00

sql_test.go

fix(scan): baseline-diff sql errors against shared templates (#304)

2026-07-22 12:48:31 -07:00

sql.go

fix(scan): baseline-diff sql errors against shared templates (#304)

2026-07-22 12:48:31 -07:00

stdout_bypass_test.go

fix(store,logger,scan): concurrency-adjacent races and correctness fixes (#343)

2026-07-22 12:55:08 -07:00

subdomaintakeover_stale_test.go

fix(scan): correlate cname before confirming subdomain takeover (#281)

2026-07-22 12:36:19 -07:00

subdomaintakeover_test.go

fix(scan): correlate cname before confirming subdomain takeover (#281)

2026-07-22 12:36:19 -07:00

subdomaintakeover.go

fix(store,logger,scan): concurrency-adjacent races and correctness fixes (#343)

2026-07-22 12:55:08 -07:00

tlscert_test.go

feat(scan): add tls certificate recon module (#274)

2026-07-22 22:35:51 +00:00

tlscert.go

feat(scan): add tls certificate recon module (#274)

2026-07-22 22:35:51 +00:00

whois.go

style: apply gofmt to source tree (#232)

2026-06-25 18:19:17 -07:00

xss_test.go

fix(scan): don't flag quotes reflected in text as attribute xss (#203)

2026-06-22 18:21:09 -07:00

xss.go

chore: migrate module path to github.com/vmfunc/sif (#194)

2026-06-22 22:25:39 -07:00