Tigah 24b573a368 fix(scan): scope passive ct-feed subdomains to the target (#181) ...

shared/multi-SAN certificates list unrelated names, so collecting every
crt.sh/certspotter entry reported off-scope hosts as subdomains of the
target. keep only the target or a subdomain of it.

2026-06-22 16:48:23 -07:00

..

builtin

refactor: dedupe url scheme stripping

2026-06-09 13:51:04 -07:00

frameworks

fix(frameworks): stop ghost detector matching the generic ghost-button (#163)

2026-06-22 16:47:43 -07:00

js

perf(scan): drain response bodies so pooled connections get reused

2026-06-10 15:50:58 -07:00

cloudstorage.go

perf(scan): drain response bodies so pooled connections get reused

2026-06-10 15:50:58 -07:00

cms_joomla_test.go

fix(scan): key joomla detection on the generator tag (#173)

2026-06-22 16:47:58 -07:00

cms.go

fix(scan): key joomla detection on the generator tag (#173)

2026-06-22 16:47:58 -07:00

cors_test.go

feat(scan): add cors, open-redirect and reflected-xss probes

2026-06-09 18:11:38 -07:00

cors.go

perf(scan): drain response bodies so pooled connections get reused

2026-06-10 15:50:58 -07:00

crawl_test.go

feat(scan): add web crawler and passive subdomain/url discovery

2026-06-09 18:11:38 -07:00

crawl.go

feat(scan): add web crawler and passive subdomain/url discovery

2026-06-09 18:11:38 -07:00

dirlist_test.go

feat(dirlist): response filters, wildcard calibration and custom wordlists

2026-06-10 14:47:17 -07:00

dirlist.go

perf(scan): work-stealing worker pool replacing static stride partition

2026-06-10 16:39:04 -07:00

dnslist_test.go

fix(scan): dnslist dedup, robots recursion bound, framework version lookup, takeover cname

2026-06-10 14:47:17 -07:00

dnslist.go

perf(scan): work-stealing worker pool replacing static stride partition

2026-06-10 16:39:04 -07:00

dork.go

perf(scan): work-stealing worker pool replacing static stride partition

2026-06-10 16:39:04 -07:00

favicon_test.go

feat(scan): add jwt, openapi and favicon-hash scanners

2026-06-10 15:50:59 -07:00

favicon.go

fix(favicon): use twmb/murmur3; spaolacci does checkptr-unsafe pointer math that crashes under -race (which CI runs)

2026-06-10 16:08:47 -07:00

fuzz_test.go

chore: bump copyright headers to 2026

2026-06-08 18:30:48 -07:00

git.go

perf(scan): work-stealing worker pool replacing static stride partition

2026-06-10 16:39:04 -07:00

headers.go

perf(scan): drain response bodies so pooled connections get reused

2026-06-10 15:50:58 -07:00

integration_test.go

feat(dnslist): async dns resolution with wildcard filtering

2026-06-10 15:30:03 -07:00

jwt_test.go

feat(scan): add jwt, openapi and favicon-hash scanners

2026-06-10 15:50:59 -07:00

jwt.go

feat(scan): add jwt, openapi and favicon-hash scanners

2026-06-10 15:50:59 -07:00

lfi_test.go

fix(scan): don't count a reflected payload as lfi evidence (#179)

2026-06-22 16:48:17 -07:00

lfi.go

fix(scan): don't count a reflected payload as lfi evidence (#179)

2026-06-22 16:48:17 -07:00

nuclei.go

refactor: dedupe url scheme stripping

2026-06-09 13:51:04 -07:00

openapi_test.go

feat(scan): add jwt, openapi and favicon-hash scanners

2026-06-10 15:50:59 -07:00

openapi.go

feat(scan): add jwt, openapi and favicon-hash scanners

2026-06-10 15:50:59 -07:00

passive_test.go

fix(scan): scope passive ct-feed subdomains to the target (#181)

2026-06-22 16:48:23 -07:00

passive.go

fix(scan): scope passive ct-feed subdomains to the target (#181)

2026-06-22 16:48:23 -07:00

ports.go

perf(scan): work-stealing worker pool replacing static stride partition

2026-06-10 16:39:04 -07:00

probe_test.go

feat: live-host probe and sarif/markdown report export

2026-06-10 14:47:17 -07:00

probe.go

feat: live-host probe and sarif/markdown report export

2026-06-10 14:47:17 -07:00

redirect_test.go

fix(scan): detect open redirects through scheme-malformed payloads (#172)

2026-06-22 16:47:52 -07:00

redirect.go

fix(scan): detect open redirects through scheme-malformed payloads (#172)

2026-06-22 16:47:52 -07:00

result.go

chore: drop decorative emoji and redundant comments

2026-06-08 18:53:06 -07:00

scan_test.go

fix(scan): dnslist dedup, robots recursion bound, framework version lookup, takeover cname

2026-06-10 14:47:17 -07:00

scan.go

perf(scan): work-stealing worker pool replacing static stride partition

2026-06-10 16:39:04 -07:00

securityheaders_test.go

fix(scan): accept quoted hsts max-age values (#176)

2026-06-22 16:48:11 -07:00

securityheaders.go

fix(scan): accept quoted hsts max-age values (#176)

2026-06-22 16:48:11 -07:00

securitytrails_test.go

feat: add securitytrails integration for domain discovery + target expansion

2026-02-17 13:38:07 +01:00

securitytrails.go

perf(scan): drain response bodies so pooled connections get reused

2026-06-10 15:50:58 -07:00

shodan_test.go

chore: bump copyright headers to 2026

2026-06-08 18:30:48 -07:00

shodan.go

perf(scan): drain response bodies so pooled connections get reused

2026-06-10 15:50:58 -07:00

sql_adminpanel_query_test.go

fix(scan): drop "query" from generic db admin-panel match (#174)

2026-06-22 16:48:05 -07:00

sql_test.go

chore: bump copyright headers to 2026

2026-06-08 18:30:48 -07:00

sql.go

fix(scan): drop "query" from generic db admin-panel match (#174)

2026-06-22 16:48:05 -07:00

subdomaintakeover.go

perf(scan): work-stealing worker pool replacing static stride partition

2026-06-10 16:39:04 -07:00

whois.go

refactor: dedupe url scheme stripping

2026-06-09 13:51:04 -07:00

xss_test.go

feat(scan): add cors, open-redirect and reflected-xss probes

2026-06-09 18:11:38 -07:00

xss.go

feat(scan): add cors, open-redirect and reflected-xss probes

2026-06-09 18:11:38 -07:00