Skip to content

CHANGELOG.md

Latest commit

 

History

History
96 lines (80 loc) · 4.89 KB

CHANGELOG.md

File metadata and controls

96 lines (80 loc) · 4.89 KB
Raw

Changelog

All notable changes to Project Lethe are documented here. The format is based on Keep a Changelog, and the project aims to follow Semantic Versioning. Dates are omitted where unknown.

[Unreleased]

Fixed

  • Payloads were double-encoded on the wire (critical). The test/discover query and form-body injection used urlencode, which re-encoded % in already-encoded payloads (e.g. %3Cscript%3E became %253Cscript%253E). The application then never saw the decoded payload, silently neutralizing the URL-encoding family of techniques. Payloads now reach the wire verbatim, with only request-invalid characters (controls, space, DEL, non-ASCII) percent-encoded.
  • Scope port over-permissiveness. A port-specific allow rule (example.com:8443) wrongly matched a default-port URL (https://example.com/). The URL's implicit port is now resolved from its scheme (https=443, http=80) so port-scoped rules match exactly; portless rules still match any port.
  • Same wire-encoding fix applied to the mutation proxy's request rewriting.

[0.15.0]

Added

  • HTTPS interception for the mutation proxy (proxy --https) via a local CA that mints per-host leaf certificates on demand. Optional [mitm] extra (cryptography); core stays dependency-free. Upstream TLS is still verified.

Changed

  • Split cli.py: extracted config coercion helpers into cli_config.py and the output formatters into cli_render.py, with no behavioral change.

[0.14.0]

Added

  • http-run: execute HTTP/1.1 discrepancy templates over raw sockets against an authorized target (HTTP/2 templates remain text-only and are skipped).
  • schema: ingest OpenAPI/Swagger or GraphQL introspection and recommend type-aware profiles, contexts, and technique tags per parameter.
  • proxy: scope-gated HTTP mutation middleware that mutates live traffic in place.
  • Export generated variants as Nuclei templates or Burp BCheck scripts (generate --format nuclei|bcheck).
  • Vendor-tuned profiles (cloudflare, akamai, aws_waf, imperva, modsecurity, f5) that fingerprint recommends automatically.
  • Path/header normalization mutators: path_empty_segment, path_dot_segment, semicolon_url_encode.
  • generate --output to write variants to a file (parity with other commands).

Fixed

  • BOM-tolerant reading of user-provided files (schema, feeds, site profile, request file, HAR) so Windows-emitted UTF-8 BOMs no longer break parsing.
  • Clarified _waf_header_signal logic (no behavioral change).

[0.13.0]

Added

  • Oracle-guided discover engine: evolves technique chains against a target, keeps survivors, flags novel bypasses, and delta-debug-minimizes them.
  • n-day knowledge feeds (feeds): an inert, versioned pack mapping bypass classes to profiles/techniques, surfaced automatically during fingerprint.
  • Per-engine and advanced techniques: MySQL/MSSQL/Postgres SQLi profiles, SSTI and shell profiles, SQL keyword comment insertion, IPv4 decimal/octal/hex encodings, and shell separator/quote mutators.
  • Trustworthy verdicts: per-target oracle calibration, multi-sample baselines, and automatic bypass re-confirmation.
  • Reflection-context detection: labels where a payload landed (HTML body, attribute, script, JSON, ...) and flags likely_exploitable.
  • New STYX://PROJECT-LETHE "canonicalization resolve" banner animation.

Changed

  • Cross-platform CI matrix (Linux/macOS/Windows x 3.10-3.13), ruff + mypy gates, noxfile.py, Dockerfile, and packaging metadata. Fixed the Windows-only test failures (temp-file handling and POSIX file-mode assumptions).

[0.12.0]

Added

  • Active testing core. test command that injects generated variants at an authorized target and classifies each response (blocked, passed, rate-limited, challenged, origin error, inconclusive) with confidence and signals.
  • Default-deny scope guard (hosts, wildcards, ports, CIDRs; flags, file, or config) enforced before any traffic is sent.
  • WAF/CDN fingerprinting with technique suggestions.
  • Concurrency, rate limiting, and proxy pass-through (--proxy).
  • Context-aware mutators (--context) and a charset/normalization engine: NFKC compatibility homoglyphs, overlong UTF-8, and inconsistent partial encoding.
  • Request import from curl, raw HTTP, or HAR (--curl/--request-file/--har, with the §INJECT§ marker).
  • Local SQLite session store and history, integrity-hashed run manifests, and versioned (schema_version) JSON output with documented exit codes.

[0.11.0]

  • Initial baseline: deterministic payload mutation engine, context profiles, explain/analyze, single-request site profiling, HTTP discrepancy templates, auth memory, and the AI safety planner/report layer.