v3.8-stable
- Fixed: Multiple bug-fixes regarding several reported unhandled exceptions.
- Revised: Minor improvement regarding parsing raw HTTP request from a file (i.e.
-roption). - Revised: Minor improvement regarding dynamic code evaluation technique (i.e. command execution output).
- Added: Translation for README.md in Farsi(Persian) (via @verfosec)
- Fixed: Minor bug-fix regarding
--skip-emptyflag, for skipping the testing of the parameter(s) with empty value(s). - Revised: Minor improvement regarding tamper script "uninitializedvariable.py", for adding randomly generated uninitialized bash variables between the characters of each command of the generated payloads.
- Revised: Minor improvement regarding skipping further tests involving target that an injection point has already been detected.
- Revised: Minor code refactoring regarding multiple tamper scripts (i.e. "backslashes.py", "dollaratsigns.py", "doublequotes.py", "singlequotes.py", "uninitializedvariable.py").
- Added: New tamper script "rev.py" that reverses (characterwise) the user-supplied operating system commands.
- Fixed: Minor bug-fix regarding checking for similarity in provided parameter(s) name(s) and value(s).
- Fixed: Minor bug-fix regarding forcing usage of SSL/HTTPS requests toward the target (i.e.
--force-sslflag). - Fixed: Minor bug-fix regarding setting custom output directory path (i.e.
--output-diroption). - Added: Support for
BearerHTTP authentication type. - Revised: Minor improvement regarding tamper script "xforwardedfor.py" (that appends a fake HTTP header
X-Forwarded-For). - Fixed: Minor bug-fix regarding not ignoring specified injection technique(s) when
--ignore-sessionor--flush-sessionoptions are set. - Replaced: The
--dependenciesoption has been replaced with--ignore-dependencies, regarding ignoring all required third-party library dependencies. - Added: New option
--alertto run host OS command(s) when injection point is found.
Note: For more check the detailed changeset.