Skip to content
WAFtester

Changelog

Release history for WAFtester. Format follows Keep a Changelog.

Changelog

All notable changes to WAFtester will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[2.8.8] - 2026-02-13

Added

  • waftester.com website — Landing page, docs, and changelog at waftester.com with Cloudflare Pages auto-deploy, security headers, and CI pipeline
  • Cross-repo references — README badge, EXAMPLES.md backlink, npm homepage, Dockerfile OCI labels, waftester-action README badge all point to waftester.com
  • FAQ doc links — Each FAQ answer links to the relevant docs section
  • Cloudflare integrations — Web Analytics, Email Routing ([email protected]), www→bare domain redirect

Fixed

  • EXAMPLES.md install command — Replaced non-existent get.waftester.com curl install with npm install -g @waftester/cli
  • Dockerfile OCI labels — Added image.url label, updated image.documentation to point to waftester.com/docs instead of GitHub README

[2.8.7] - 2026-02-13

Fixed

  • SonarQube severity mapping divergence — Batch exports (builder.go) mapped Critical→BLOCKER, High→CRITICAL, Medium→MAJOR, default→MINOR while streaming exports (writers/) mapped Critical→CRITICAL, High→MAJOR, Medium→MINOR, default→INFO; consolidated to single canonical mapping on finding.Severity.ToSonarQube()
  • GitLab SAST severity missing Info level — Batch export defaulted unknown severity to “Low” instead of “Info”; now matches streaming path via finding.Severity.ToGitLab()
  • Batch export case mismatch — SARIF/SonarQube/GitLab batch export functions switched on title case (“Critical”) but received lowercase (“critical”) from payload SeverityHint, causing all severities to fall through to default; now uses finding.Severity type which matches lowercase constants

Refactored

  • Severity mapping consolidation — 8 duplicate severity mapping functions across builder.go, writers/sonarqube.go, writers/gitlab_sast.go, writers/sarif.go replaced with 4 canonical methods on finding.Severity: ToSonarQube(), ToGitLab(), ToSARIF(), ToSARIFScore()
  • severityOrder elimination — 3 identical severityOrder() functions in report/report.go, exploit/exploit.go, correlation/correlation.go replaced with existing finding.Severity.Score() method
  • Code cleanup — Formatting alignment, trailing whitespace, blank line removal across 9 files

[2.8.6] - 2026-02-13

Security

  • HTML injection in compliance reports — 6 user-controlled values interpolated into HTML without escaping in pkg/report/compliance.go; all now wrapped in html.EscapeString

Fixed

  • Nil pointer dereference in compliance report — GenerateComplianceReport panicked when stats was nil; added nil guard in MapResults

  • Nil pointer dereference in task submission — Coordinator.SubmitTask(nil) panicked dereferencing nil task; added nil check before lock

  • Go 1.24 JSON marshal failure — ExecutionResults.Duration (time.Duration) had no JSON format tag, breaking json.Marshal in Go 1.24+; added json:"duration,omitzero,format:nano"

  • Division by zero in tamper metrics — RecordLatency panics when called with empty tamper chain; added length guard

  • Decimal-to-hex conversion in MySQL CHAR transform — CharlongEscape emitted 0x65 as 0x101 (string concat instead of integer conversion); now uses strconv.Atoi + fmt.Sprintf

  • Data loss in SQL Concat obfuscation — Unterminated string at end of input silently dropped; now flushed after loop

  • Filter AND mode false negatives — Regex, String, and CDN filter criteria only appended matched=true, breaking AND mode when criteria didn’t match; now always append the boolean result

  • Concurrent map access in filter — seenHashes map read/written without synchronization under concurrent use; added sync.Mutex

  • Correlator marks unrelated findings as fixed — DetectFixedFindings ignored scan target and tested finding types, marking SQLi as fixed during an XSS-only scan; now scopes to matching target and tested types

  • Per-payload category lost in evasion matrix — Build fell back to categories[0] for all payloads; now tracks per-payload category from NewFromCategories

  • Ignored template parse error — report.go discarded template.New().Parse() error with _ =; replaced with template.Must

  • Silent JSON marshal failure in HTML report — Template func returned empty string on error; now returns "null"

  • CSV header write errors ignored — newCSVWriter never checked writer.Write or Flush errors for the header row; errors now propagated

  • Silent writer creation failures — enhanced.go silently ignored errors from individual writer creation; now logs each failure with slog.Warn

  • Discarded JSON marshal error in OpenAPI generator — generateJSONBody returned empty bytes on marshal failure; now falls back to raw payload

  • Checkpoint close error lost — SaveCompletedToFile used bare defer f.Close(), discarding close errors; now captured via named return

  • Scoring formula comment wrong — Documented max as 19, actual max is 22.5; comment corrected

  • Retry sleep ignores context cancellation — executor_test_runner.go used time.Sleep in retry loop; replaced with select on ctx.Done() / time.After

  • Regex compiled on every call in SSTI detect — regexp.MustCompile in hot path replaced with regexcache.MustGet

  • Regex compiled on every call in false positive — regexp.Compile in containsPattern loop replaced with regexcache.Get

  • Distributed task silently dropped — Full queue drops tasks with no logging or status update; now logs warning and marks task as failed

  • Distributed worker goroutine leak — Worker.Run only selected on ctx.Done(), ignoring StopChan; now selects on both

  • Distributed double-close panic — Worker.Stop() could panic on double close(StopChan); wrapped with sync.Once

  • Distributed shutdown with no timeout — Shutdown(context.Background()) blocks forever; changed to 10-second timeout

  • Distributed stale tasks on unhealthy nodes — checkNodeHealth detected unhealthy nodes but left their tasks stranded; now reschedules back to queue

  • npm package version mismatch — npm/cli/package.json still at 2.8.5 after version bump; updated to 2.8.6

  • Workerpool deadlock — Redesigned Submit locking to split into fast path (non-blocking under RLock) and slow path (blockingSend without locks), preventing deadlock when Close needs write lock while Submit blocks on full channel

  • Output file close errors — All 11 export functions (writeResultsJSON, writeResultsJUnit, writeResultsCSV, etc.) now capture f.Close() errors via named returns and closeFile helper instead of silently discarding them with defer f.Close()

  • JWT marshal errors — 3 json.Marshal calls in ClaimTamperAttack now check and return errors with context instead of silently discarding them

  • Workerpool data race — Submit read p.workers non-atomically while Resize wrote it with atomic.StoreInt32; both reads now use atomic.LoadInt32

  • Output file handle leak — BuildDispatcher missing cleanup() call on GitHub Issues hook error, leaking all previously opened file descriptors

  • Silent write errors in JUnit/HTML/Markdown exports — writeResultsJUnit, writeResultsHTML, and writeResultsMarkdown discarded fmt.Fprintf errors, silently producing corrupt files on disk-full; all write errors now checked and propagated

  • JWT JKU token corruption — JKUSpoofAttack ignored json.Marshal errors on header and claims, producing malformed tokens; errors now checked with descriptive messages

  • Path traversal in workflow output — Engine.executeStep wrote command output to user-controlled path without validation; now calls validateFilePath before writing

  • Command injection via workflow allowlist — cmd and cmd.exe were in the allowed command list, permitting arbitrary execution via cmd /c; removed from allowlist, added ExtraAllowedCommands field for controlled override

  • Empty WorkDir bypassed path validation — validateFilePath allowed any absolute path when WorkDir was empty; now defaults to os.Getwd()

  • Recursive fuzzer deadlock — wg.Wait() in goroutine blocked forever when queue drained naturally; replaced with atomic inFlight counter and monitor goroutine that closes queue at zero

  • Screenshot goroutine leak — BatchCapturer.Stop() closed channels before workers drained, leaving goroutines blocked; added sync.WaitGroup tracking so Stop waits for workers before closing channels

  • Context leak in recursive fuzzer — context.WithCancel in Run never called cancel on normal completion; added defer cancel()

  • HTTP GET with no timeout in fuzz CLI — http.Get(*wordlist) had no timeout or context; replaced with http.NewRequestWithContext using 30-second timeout

  • Bare type assertions in CLI dispatch — 11 opts.(*XOptions) assertions in cli.go panicked on wrong type; converted to comma-ok with descriptive fmt.Errorf

  • Bare type assertions in GenerateReport — 4 files (upload.go, oauth.go, deserialize.go, apifuzz.go) used interface{} round-trip in report generation; replaced with typed local variables

  • Bare sync.Map assertions in DNS cache — 3 entry.(*cacheEntry) assertions in dnscache.go panicked on corrupt cache; converted to comma-ok with error returns

  • Bare sync.Map assertions in host errors — 3 v.(*hostState) assertions in hosterrors.go panicked on corrupt state; converted to comma-ok with nil guards

  • Bare sync.Map assertion in discovery — key.(string) in active_extraction.go panicked on non-string key; converted to comma-ok with empty guard

  • Gzip close error swallowed — saveToCache in corpus.go used defer gzWriter.Close() discarding flush errors; now uses named return with deferred error capture

  • Timer leak in health waiter — time.After in loop created uncollectable timers each iteration; replaced with time.NewTimer + Stop

  • Non-portable path construction — nuclei.go used string concatenation (dir + "/" + name) instead of filepath.Join

Added

  • Gap test suite — 13 new test files covering 6 structural testing gaps identified across rounds 1-4: type safety (cli, dnscache, hosterrors), error propagation (output, corpus, checkpoint), security boundaries (compliance HTML injection), concurrency (workerpool, filter, distributed), goroutine leaks (screenshot), and context cancellation (recursive)
  • Shared test helpers — pkg/testutil package with FailingWriter, GoroutineTracker, AssertNoPanic, AssertTimeout, RunConcurrently, PoisonSyncMap
  • Workerpool regression test — TestPool_BlockingSendCloseDeadlock reproduces the exact deadlock scenario (tiny buffer, blocked workers, concurrent Close) with timeout detection

[2.8.5] - 2026-02-11

Changed

  • Enterprise refactoring complete — 26-phase structural overhaul (166/173 tasks): shared finding types, shared attack config, centralized errors, CLI decomposition, utility deduplication, context propagation, god file decomposition, magic number extraction, extended test coverage
  • Context propagation — All long-running operations now accept context.Context for clean cancellation and goroutine safety
  • God file decomposition — Split 6 oversized files (mcpserver/tools.go, report/html_report.go, ssti/ssti.go, osint/osint.go, discovery/ god files, core/executor.go) into focused modules

Fixed

  • OWASP DRY violation — Replaced 8 hardcoded OWASP category strings in pkg/report/html_vulndb.go with defaults.OWASPTop10 map references
  • Goroutine leaks — Fixed resource leaks in interactive.inputLoop, distributed.StartDistributor, leakypaths work sender, and deserialize.Scan
  • Race conditions — Fixed 7 data races across scoring, waf, detection, workerpool, runner, oob, and calibration packages
  • Dead code cleanup — Removed ~235 LOC of confirmed dead code (nil/nil stubs, unused functions)

Internal

  • 44 structural enforcement tests preventing regression
  • All attack packages use shared finding.Vulnerability and attackconfig.Base types
  • Shared retry engine, signal handling, and structured logging across CLI
  • Performance: buffer pooling, JSON streaming, slice preallocation in hot paths

[2.8.4] - 2026-02-10

Changed

  • Version bump — Baseline release before enterprise refactoring

Internal

  • Established v2.8.4 as pre-refactoring baseline tag
  • All refactoring (Phases 1-25) will build on this release

[2.8.3] - 2026-02-09

Security

  • Fork PR supply-chain hardening — docker-publish.yml and release.yml now filter workflow_run.event == 'push' to prevent fork PRs from triggering Docker pushes or releases via workflow_run (which runs with base repo secrets regardless of trigger source)
  • SHA-pinned all GitHub Actions — All workflow actions across CI, Docker, Release, npm-publish, rebuild-assets, and private-guard now use immutable commit SHAs instead of floating tags
  • Removed eval in entrypoint.sh — Replaced eval "CMD+=(${INPUT_ARGS})" with xargs-based argument parsing to eliminate shell injection risk from args input
  • Heredoc output injection prevention — GitHub outputs now use PID-unique heredoc delimiters to prevent output injection from malicious target URLs
  • Markdown table sanitization — Finding category names are now stripped of |, backtick, and backslash characters to prevent Markdown injection in job summaries

Fixed

  • workflow_run.branches filter blocking tag releases — Removed branches: [main] from docker-publish.yml and release.yml which silently prevented tag-triggered workflow_run events from firing
  • Docker concurrency group always miss — startsWith(github.event.workflow_run.head_branch, 'refs/tags/') was always false because head_branch is the tag NAME (e.g. v2.9.0), not the full ref; changed to startsWith(..., 'v')
  • Prerelease tags pushing floating Docker tags — Prerelease tags (e.g. v2.9.0-rc1) now only get sha- Docker tag, not latest/edge/semver floats
  • Shallow clone defeating author identity check — private-guard.yml now uses fetch-depth: 6 so git log HEAD~5..HEAD doesn’t fail silently
  • GoReleaser version pinning — Changed from version: latest to version: '~> v2' in release and rebuild-assets workflows to prevent breaking changes
  • Release notes handling — Uses --notes-file instead of --notes for release note merging to avoid shell escaping issues with multiline content

Changed

  • Private file guard expanded — REQUIRED_IGNORES list expanded from 6 to 12 paths (added .github/copilot-instructions.md, .github/memory-seed.json, .claude/, .mcp.json, .vscode/, docs/plans/, docs/research/)
  • npm-publish chain filter — Added event != 'pull_request' filter with documentation explaining chained workflow_run.event semantics
  • Dockerfile consistency check — Now handles multi-source COPY instructions (e.g. COPY go.mod go.sum ./)
  • Structural test coverage — TestNoPrivateFilesInRepo gitignore check expanded from 10 to 12 rules

[2.8.2] - 2026-02-10

Fixed

  • Progress bar overflow — allScanTypes progress tracking list had only 25 entries but 38 runScanner() calls existed, causing progress to display 140% (e.g., 35/25) and spinner to hang after scan completion
  • Dry-run list out of sync — Dry-run mode allScanTypes list was missing graphql, subtakeover, apifuzz, wafevasion, and tlsprobe scan types, causing --dry-run to undercount available scans
  • Both allScanTypes lists now include all 38 scan types matching every runScanner() call: sqli, xss, traversal, cmdi, nosqli, hpp, crlf, prototype, cors, redirect, hostheader, websocket, cache, upload, deserialize, oauth, ssrf, ssti, xxe, smuggling, graphql, jwt, subtakeover, bizlogic, race, apifuzz, wafdetect, waffprint, wafevasion, tlsprobe, httpprobe, secheaders, jsanalyze, apidepth, osint, vhost, techdetect, dnsrecon

[2.8.1] - 2026-02-09

Added

  • GitHub Actions Marketplace — Official waftester-action published. Zero-install CI/CD integration with uses: waftester/waftester-action@v1. Supports all scan types, SARIF upload, version pinning, and SHA-256 verified binary downloads.

Fixed

Master Audit — 14 Bug Fixes

Comprehensive audit identified and fixed 14 bugs across CLI, MCP server, core executor, detection, and output subsystems.

Critical & High Priority:

  • Rate limiting not wired (CRIT-1): scanLimiter was created but never called in runScanner(). Now uses golang.org/x/time/rate with scanLimiter.Wait(ctx) before every request.
  • maxErrors death-spiral (CRIT-2): maxErrors flag was declared but never enforced. Now calls cancel() when error count exceeds threshold.
  • Nil dispatcher panics (HIGH-2): 5 dispCtx.EmitError() / runDispCtx.EmitError() calls could panic when dispatcher is nil. All guarded with nil checks.
  • Raw HTTP transport (HIGH-4): cmd_scan.go built a manual &http.Transport{} instead of using httpclient.New() factory. Missed DNS cache, HTTP/2, sockopt, and detection wrapper. Replaced with httpclient.FuzzingConfig() + httpclient.New().
  • Detection singleton cross-contamination (HIGH-6): All executors shared detection.Default() singleton. Concurrent MCP scans to the same host corrupted each other’s drop/ban state. Each executor now creates detection.New() and wires it into its transport wrapper.
  • No signal handler (HIGH-7): Ctrl+C during CLI scan leaked goroutines and connections. Added SIGINT/SIGTERM handler that calls cancel() for graceful shutdown.
  • Scan cancellation discards results (HIGH-1): MCP task.Fail("scan cancelled") threw away all partial results. Now returns whatever was collected with “PARTIAL RESULTS” annotation.

Medium Priority:

  • Timeout flag misleading (MED-2): -timeout 30 means 30s per-request but 30-minute scan deadline. Clarified flag description and changed *timeout*60*time.Second to time.Minute.
  • Mutation explosion (MED-3): Bypass tool accepted unlimited payloads — 100 payloads × encoders could silently generate 15K+ requests. Added guard rejecting >50 payloads with helpful guidance.
  • ReadOnlyHint wrong (MED-4): detect_waf, discover, and probe tools marked ReadOnlyHint: true despite sending HTTP probes to targets. Fixed to false so MCP clients prompt user confirmation.
  • Division by zero (HIGH-3): cmd_tests.go divided by Duration.Seconds() for RequestsPerSec without checking for zero duration. Guarded with secs > 0 check.

Resource Leaks:

  • Transport leak (HIGH-5): Executor had no Close() method — idle HTTP connections accumulated. Added Close() with CloseIdleConnections() and detector.ClearAll().
  • File handle leak (MED-5): JSONWriter.Close() and SARIFWriter.Close() leaked file handles when json.Encode() failed — early return skipped file.Close(). Fixed with deferred close.
  • Detection state leak (HIGH-6b): Removed detection.Default().Clear() from 4 MCP handlers — no longer needed with per-executor detector lifecycle.

Changed

  • cmd/cli/cmd_scan.go: Delay+jitter support wired into runScanner() with context cancellation check
  • pkg/mcpserver/tools.go: Detection rate now annotated with skipped count when hosts unreachable
  • Replaced misleading silence block at end of cmd_scan.go with explicit TODO(v2.9.0) comments

[2.8.0] - 2026-02-08

Added

npm Distribution (@waftester/cli)

WAFtester is now available on npm for zero-dependency installs. Enables one-liner MCP server setup for Claude Desktop, VS Code, and Cursor.

  • npx -y @waftester/cli one-liner: Run WAFtester without installing Go or downloading binaries. Downloads the correct platform binary automatically via optionalDependencies.
  • 6 platform packages: @waftester/darwin-x64, @waftester/darwin-arm64, @waftester/linux-x64, @waftester/linux-arm64, @waftester/win32-x64, @waftester/win32-arm64.
  • MCP server via npx: npx -y @waftester/cli mcp starts the MCP server with bundled payloads and templates. Claude Desktop, VS Code, and Cursor configs now use npx as the command.
  • ARM64 emulation fallback: On macOS arm64 with missing native package, falls back to x64 binary under Rosetta 2. Same for Windows ARM.
  • Yarn PnP detection: Detects .zip/ paths from Yarn PnP and directs users to set preferUnplugged: true.
  • Environment variable override: WAF_TESTER_BINARY_PATH for development/debugging.
  • Provenance attestation: All npm packages published with --provenance for supply chain verification (npm audit signatures).
  • Automated CI/CD: npm-publish.yml workflow chains after GoReleaser release, extracts archives, builds 7 packages, publishes with idempotency checks, and verifies provenance.
  • Stdout purity: Node.js bin shim uses only console.error (0 console.log calls), ensuring clean stdio transport for MCP.

Changed

  • README: Added npm badge, npm/npx install section as recommended method, MCP configs updated to use npx
  • INSTALLATION.md: Added npm/npx section with platform table and environment variables
  • SECURITY.md: Updated supported versions table for 2.8.x

[2.7.8] - 2026-02-09

Fixed

Silent Scan Death Spiral (4-Bug Chain)

Production scans were returning Blocked: 0, Bypassed: 0, Errors: 12 with 3340/3352 payloads silently vanishing. Root cause: a chain of 4 interacting bugs that created a “death spiral” — once a host started failing, errors cascaded faster than they could be reported.

  • Bug A — Stale global state across MCP scans: hosterrors and detection singletons were never cleared between MCP scan invocations. A host marked as failing in scan 1 would be pre-poisoned for scan 2, causing immediate skip of all payloads. Fixed by adding hosterrors.Clear() + detection.Default().Clear() at the start of all 4 MCP async handlers (scan, assess, bypass, discover).

  • Bug B — Rate limiter before skip check: Skipped payloads were waiting for a rate-limit token before being discarded. With 3340 skipped payloads × 20ms rate limit = 66 seconds wasted on payloads that would never be sent. Fixed by moving hosterrors.Check() and ShouldSkipHost() before limiter.Wait() in both Execute() and ExecuteWithProgress().

  • Bug C — No death spiral detection: When a host went down, all remaining payloads would be individually checked, skipped, and rate-limited — no early abort. Fixed by adding death spiral detection: after 50 completions, if >80% are skipped, the scan context is cancelled and remaining payloads are abandoned.

  • Bug D — Skipped payloads invisible in results: The Skipped outcome was never tracked or reported. Users and AI agents saw Blocked: 0, Bypassed: 0, Errors: 12 with no indication that 3340 payloads were silently dropped. Fixed by adding HostsSkipped counter to both execution paths, progress callbacks, summary output, and interpretation text.

CLI Audit Fixes

  • False bypass alerts for skipped payloads: OnResult callback in CLI test command was emitting skipped payloads as bypass events to Slack, Teams, PagerDuty, OTEL, and Prometheus. Fixed by filtering Outcome != "Skipped".
  • Multi-target aggregation missing HostsSkipped: When running test against multiple targets, skipped count was not aggregated in the combined summary.
  • ui.PrintSummary box missing skipped row: The pretty summary box showed Total/Blocked/Pass/Fail/Errors but not Skipped. Added [>>] N row when skipped > 0.
  • output.PrintSummary missing skipped line: The WAF Security Test Summary printed Total/Blocked/Pass/Fail/Errors without Skipped, causing the math to not balance. Added ⏭ Skipped: N (host unreachable) line.
  • scan command missing hosterrors check: The runScanner helper checked detection.ShouldSkipHost() but not hosterrors.Check(), allowing scanners to run against hosts known to be failing from previous scanners.

Added

  • buildSkippedResult() helper on Executor — creates proper TestResult with Outcome: "Skipped", zero risk score, and descriptive error message
  • Death spiral detection in both Execute() and ExecuteWithProgress() — aborts scan when >80% of first 50 completions are skipped
  • HostsSkipped field now populated in ExecuteWithProgress() (was defined but never set)
  • Skipped-aware interpretation and next-steps in MCP scan tool response

Changed

  • TestRateLimiting threshold relaxed from 2.0s to 1.8s to prevent flaky CI failures from timing jitter

[2.7.7] - 2026-02-08

Added

Cross-Session Task Recovery

MCP clients like n8n create a new session (full initialize handshake) for every AI agent turn. When assess returns a task_id in turn 1 and the AI needs to poll with get_task_status in turn 2, the new session means the AI often loses or hallucinates the task_id. This release makes task recovery automatic and session-independent.

  • task_id now optional in get_task_status: When omitted, the server auto-discovers the most recent active task. Prefers running/pending tasks over completed ones — exactly what a reconnecting client needs.
  • tool_name parameter in get_task_status: When task_id is omitted, filter auto-discovery by which tool started the task (e.g., "assess", "scan"). Eliminates ambiguity when multiple tasks exist.
  • GetLatest() method on TaskManager: Returns the most recently created non-terminal task, falling back to the most recently updated terminal task. Accepts optional tool name filter. Thread-safe with proper lock ordering.
  • tool_name filter in list_tasks: Filter task listings by tool name (e.g., {"tool_name": "scan"}). Can combine with existing status filter.
  • Cross-session recovery workflow in serverInstructions: Explicit instructions telling AI agents: “If you lost the task_id, call get_task_status without parameters or use list_tasks to discover tasks.”

Auto-Discovery Examples

# Recover latest task (any tool):
get_task_status {"wait_seconds": 30}

# Recover latest assess task specifically:
get_task_status {"tool_name": "assess", "wait_seconds": 30}

# List all running tasks to pick one:
list_tasks {"status": "running"}

# Filter by tool and status:
list_tasks {"tool_name": "scan", "status": "running"}

Tests

  • Added TestGetTaskStatus_AutoDiscovery_FindsActiveTask — auto-discovers running task when task_id omitted.
  • Added TestGetTaskStatus_AutoDiscovery_FindsCompletedTask — falls back to completed task when no active tasks.
  • Added TestGetTaskStatus_AutoDiscovery_PrefersActiveOverCompleted — running tasks preferred over completed.
  • Added TestGetTaskStatus_AutoDiscovery_ByToolName — tool_name filter finds correct task.
  • Added TestGetTaskStatus_AutoDiscovery_NoMatchingTool — returns error when no tasks match filter.
  • Added TestListTasks_WithToolNameFilter — filters task list by tool name.
  • Added TestListTasks_WithToolNameAndStatusFilter — combined tool_name + status filtering.
  • Added TestGetLatest_EmptyManager — nil on empty TaskManager.
  • Added TestGetLatest_SingleActiveTask — finds the only active task.
  • Added TestGetLatest_PrefersActiveOverTerminal — prefers running over completed.
  • Added TestGetLatest_FallsBackToTerminal — returns completed when no active tasks.
  • Added TestGetLatest_MostRecentActive — returns most recently created active task.
  • Added TestGetLatest_WithToolFilter — tool filter works correctly.
  • Added TestGetLatest_ToolFilterNoMatch — nil when filter doesn’t match.
  • Updated TestGetTaskStatus_MissingTaskID — now tests auto-discovery “no tasks found” path.
  • 257 tests total, all passing.

[2.7.6] - 2026-02-08

Fixed

MCP Task ID Format Validation

AI agents (particularly via n8n) were hallucinating UUID-format task IDs instead of using the exact task_id returned by async tools. The server now validates task ID format before map lookup and returns specific, actionable error messages.

  • ValidateTaskID function: Validates that task IDs match the expected format (task_ prefix + exactly 16 hex characters, no dashes). Returns human-readable reason on failure with correction instructions.
  • Format validation in get_task_status and cancel_task: Both tools validate task ID format before lookup, preventing generic “not found” errors for malformed IDs.
  • Actionable error messages: Invalid format errors include the submitted ID, correct format example, and pointers to list_tasks — enabling AI agents to self-correct.
  • Server instructions updated: serverInstructions now explicitly documents task ID format (task_a1b2c3d4e5f6g7h8) and warns against UUIDs or modified IDs.
  • Tool descriptions updated: get_task_status description now includes TASK ID FORMAT documentation line.

wait_seconds Default Fix

The wait_seconds parameter in get_task_status now correctly defaults to 30 seconds when omitted, instead of Go’s zero-value (0). Changed from int to *int pointer type to distinguish “not provided” from “explicitly 0”.

  • *int pointer type: WaitSeconds field uses pointer semantics — nil means “use default 30s”, explicit 0 means “no waiting”.
  • defaultWaitSeconds constant: Centralized default value (30) with clear documentation explaining the JSON schema vs Go unmarshaling mismatch.

Tests

  • Added TestValidateTaskID — table-driven test covering valid IDs, UUID format, too-short, too-long, non-hex chars, wrong prefix, and other edge cases.
  • Added TestGetTaskStatus_InvalidFormat_UUID — integration test simulating n8n’s AI agent hallucinating UUID task IDs.
  • Added TestGetTaskStatus_InvalidFormat_TooShort — integration test for truncated task IDs.
  • Added TestGetTaskStatus_WaitSecondsDefault — verifies omitted wait_seconds defaults to 30s (waits for completion).
  • Added TestGetTaskStatus_WaitSecondsExplicitZero — verifies explicit wait_seconds=0 returns immediately without blocking.
  • Updated TestGetTaskStatus_NonexistentTask — uses valid-format but nonexistent task ID.
  • Updated TestCancelTask_NonexistentTask — uses valid-format but nonexistent task ID.

[2.7.5] - 2026-02-08

Added

MCP Observability Logging

Production-grade request and tool invocation logging for diagnosing MCP client integration issues (n8n, Claude Desktop, etc.).

  • HTTP request logger: Every incoming HTTP request is logged with method, path, Mcp-Session-Id, content-type, content-length, remote address, response status, and duration. Inserted as the outermost middleware layer.
  • Tool call logger: Every MCP tool invocation is logged on entry (with truncated arguments) and exit (with success/error status and duration). Uses a loggedTool wrapper applied to all 13 tools.
  • Task lifecycle logging: TaskManager.Create, Complete, Fail, Cancel, Get (miss), and cleanup all log structured events with [mcp-task] prefix including task IDs and counts.
  • Log prefixes: [mcp-http] for HTTP layer, [mcp-tool] for tool invocations, [mcp-task] for task lifecycle — enables easy grep-based filtering in container logs.

[2.7.4] - 2026-02-08

Fixed

MCP Async Task Reliability (n8n Integration)

  • Stdio sync mode: Long-running tools now execute synchronously when connected via stdio transport. Each stdio invocation is a separate process, so in-memory async task state was lost between calls — causing “task not found” errors. Stdio has no HTTP timeout, so synchronous execution is safe.
  • Long-poll wait_seconds: get_task_status now accepts wait_seconds (0–120, default 30) to block until the task completes or the timeout elapses. Reduces polling overhead from many rapid calls to 2–4 efficient long-polls per operation.
  • Task completion signaling: Tasks now use a done channel closed on terminal state transitions (Complete, Fail, Cancel), enabling efficient blocking in WaitFor instead of busy-polling.
  • Stronger agent instructions: Server instructions now explicitly forbid agents from returning “check back later” messages — agents must poll in a loop with wait_seconds=30 until the task reaches a terminal state within the same execution context.
  • Diagnostic logging: Task lifecycle events (create, complete, fail, panic) are now logged with [mcp] prefix for production debugging of task state issues.

Tests

  • Added TestWaitForCompletesImmediatelyWhenDone — verifies WaitFor returns instantly for completed tasks.
  • Added TestWaitForTimesOut — verifies WaitFor respects timeout parameter.
  • Added TestWaitForUnblocksOnCompletion — verifies WaitFor unblocks when task completes during wait.
  • Added TestWaitForUnblocksOnContextCancel — verifies WaitFor respects context cancellation.
  • Added TestSyncModeDefault — verifies sync mode is off by default (HTTP/SSE transport).
  • Added TestGetTaskStatusWaitSeconds — end-to-end test of long-poll via MCP tool call.

[2.7.3] - 2026-02-08

Added

Async Task Pattern — Timeout-Proof MCP Operations

Long-running MCP tools (scan, assess, bypass, discover) now return a task_id immediately instead of blocking. This prevents MCP error -32001: Request timed out errors that occurred when operations exceeded client timeout limits (60s for n8n, 30-120s for other clients).

  • TaskManager (pkg/mcpserver/taskmanager.go) — concurrent-safe async task lifecycle manager with automatic cleanup (30min TTL), max 100 active tasks, 30min hard timeout per task, and graceful shutdown with goroutine drain
  • 3 new MCP tools: get_task_status (poll for results), cancel_task (stop running tasks), list_tasks (view all task states)
  • launchAsync helper — shared goroutine launcher with panic recovery, WaitGroup tracking, and immediate task_id response
  • Polling pattern: call async tool → receive task_id → poll get_task_status every 5-10s → get full result when completed
  • Progress tracking: tasks report percentage, current step, and estimated duration
  • Terminal state guards: prevent race conditions between Cancel→Fail, Complete→Fail, and Fail→Complete transitions
  • Server instructions: updated with ASYNC TOOL PATTERN section, tool table marks async tools, fast vs async tool classification
  • Prompt updates: all 6 guided workflow prompts include async polling instructions for long-running steps

HTTP Middleware Stack — Production Hardening

  • recoveryMiddleware — catches panics in HTTP handlers, returns 500 JSON error instead of killing the connection
  • securityHeaders — adds X-Content-Type-Options: nosniff and X-Frame-Options: DENY to all responses
  • SSE keep-alive — sends :keepalive comments every 15s to prevent reverse proxy idle timeouts (nginx, AWS ALB, Cloudflare, Docker)
  • keepAliveWriter — thread-safe ResponseWriter wrapper with mutex-serialized writes, Flush() for SSE streaming, and Unwrap() for Go 1.20+ ResponseController discovery
  • SSE handler chain — SSEHandler now includes recoveryMiddleware → securityHeaders → sseKeepAlive → sse

Fixed

MCP Server Fixes

  • WriteTimeout removed — WriteTimeout: 60s set an absolute deadline that killed SSE connections; removed so SSE streams survive indefinitely (ReadHeaderTimeout + ReadTimeout still protect against slowloris)
  • CORS spec compliance — no CORS headers when Origin is absent (setting * with Allow-Credentials violates the Fetch specification); Vary: Origin always set for cache correctness
  • CORS headers expanded — MCP-Protocol-Version added to Access-Control-Allow-Headers and Access-Control-Expose-Headers
  • Silent exit on no transport — waf-tester mcp with --stdio=false and no --http now prints an error and exits with code 1 instead of silently exiting
  • Server.Stop() — properly cancels all running tasks, waits for goroutine drain (10s timeout), and stops the cleanup goroutine
  • SetProgress terminal guard — no longer overwrites progress messages on cancelled/completed/failed tasks
  • Grade table — fixed B+ → B and added missing D grade in server instructions
  • WAF signatures description — clarified “12 WAF vendor signatures” → “12 of 26 WAF vendors with detailed bypass tips”
  • Server instructions — corrected “17 commands” → “13 tools”; resource list now includes waftester://templates and waftester://payloads/unified
  • Template count — corrected 41 → 40 in version resource, templates resource description, and total_templates field
  • scanArgs schema — added missing Policy and Overrides fields to match InputSchema
  • detect_waf error hint — changed “Try with skip_verify=true” → “Use ‘probe’ with skip_verify=true” (detect_waf has no skip_verify parameter)
  • generate_cicd platform validation — explicit validPlatforms map check before generating YAML; rejects unsupported platforms with clear error
  • Prompt format strings — fixed %%%% → %% in full_assessment and template_scan prompts (4 instances)

Tests

  • Goroutine leak prevention — added defer srv.Stop() / t.Cleanup(func() { srv.Stop() }) to all 23 test and benchmark functions that create mcpserver.New(), preventing TaskManager goroutine leaks (~60+ per test run)
  • TestCORSDefaultOrigin — updated to assert absence of CORS headers when no Origin is present (per Fetch spec), plus Vary: Origin always present
  • TestCORSHeaders — added Vary: Origin and MCP-Protocol-Version assertions
  • Async tool tests — 15 new tests covering task lifecycle, polling, cancellation, list filtering, sync validation errors, and all 4 async tools returning task_id
  • TaskManager tests — 20 new tests covering ID generation, lifecycle transitions, concurrent access, max capacity, cleanup, terminal state guards, context deadlines, and WaitGroup drain
  • Tool count assertions — updated from 10 to 13 in TestListTools, TestHTTPTransportListTools, TestToolsIterator

[2.7.2] - 2026-02-07

Added

Unified Payload Provider (pkg/payloadprovider)

Bridges the JSON payload database (2,800+ payloads) and Nuclei template system (~226 vectors) into a single unified provider:

  • payloadprovider.Provider — loads both sources, merges with deduplication, provides category-aware queries (GetByCategory, GetByTags, GetStats)
  • payloadprovider.CategoryMapper — bidirectional mapping for 20+ categories (e.g. sqli ↔ SQL-Injection, lfi ↔ Path-Traversal)
  • Template enrichment — --enrich flag on template command injects JSON payloads into Nuclei templates for maximum bypass coverage
  • Scan enrichment — scan command WAF evasion scanner now pulls payloads from the unified provider instead of 3 hardcoded strings
  • MCP integration — new waftester://payloads/unified resource; list_payloads tool reports unified stats; prompts reference the bridge
  • Smart mode — GetTemplateRecommendations suggests vendor-specific JSON payload files and the --enrich flag
  • Default constants — defaults.PayloadDir and defaults.TemplateDir replace all hardcoded path strings
  • 23 unit tests — table-driven tests for provider, mapper, edge cases

Pre-Built Template Library

WAFtester now ships a complete templates/ directory in release archives and Docker images, providing ready-to-use configurations for every template system:

  • 17 Nuclei templates — WAF bypass (SQLi, XSS, RCE, LFI, SSRF, SSTI, CRLF, XXE, NoSQLi) and vendor detection (Cloudflare, AWS WAF, Akamai, ModSecurity, Azure WAF), plus a full assessment workflow
  • 5 workflow templates — Full scan, quick probe, CI gate, WAF detection, API scan
  • 5 policy templates — Permissive, standard, strict, OWASP Top 10, PCI-DSS compliance gates
  • 3 override templates — False positive suppression, API-only mode, CRS tuning
  • 6 output templates — CSV, ASFF (AWS Security Hub), JUnit XML, Markdown, Slack notification, text summary
  • 5 report config templates — Minimal, enterprise, dark theme, compliance, print/PDF

Template Validation Tests

  • 11 structural tests validate all shipped templates: Nuclei YAML fields, workflow steps, policy names, override structure, Go template syntax, report config format, directory integrity
  • CI enforcement ensures templates ship in release archives (goreleaser) and Docker images

CLI Flag Consistency Audit

Comprehensive audit and fix of all 33 CLI commands for unified payload flag consistency:

  • scan command — added --payloads and --template-dir flags; WAF evasion scanner now uses configurable directories instead of hardcoded defaults
  • grpc / soap / openapi — added --payloads and --template-dir flags; unified fuzz payloads now respect custom directories
  • assess command — added --payloads flag wired to assessment.Config.PayloadDir
  • template command — renamed --payload-dir to --payloads for cross-command consistency
  • validate-templates — fixed default from "../templates" to defaults.TemplateDir
  • unified_payloads.go — all shared helpers now accept templateDir parameter instead of hardcoding defaults.TemplateDir
  • MCP server — validatePayloadDir now uses user-supplied --templates directory for unified payload counts

Fixed

  • Templates included in releases — templates/**/* added to .goreleaser.yaml archive files (previously only payloads/ and source-internal configs shipped)
  • Templates included in Docker — COPY templates/ ./templates/ added to Dockerfile
  • Report config paths — Examples and workflows reference canonical templates/report-configs/ instead of source-internal pkg/report/templates/configs/
  • MCP resource count — version resource correctly reports 10 resources (was 9)
  • CLI flag naming — template --payload-dir renamed to --payloads to match all other commands
  • MCP startup validation — validatePayloadDir now uses user-supplied --templates value instead of hardcoded default
  • validate-templates default path — changed from "../templates" to defaults.TemplateDir (./templates/nuclei)

2.7.1 - 2026-02-07

Security

  • Removed insecure crypto fallbacks — generateCacheBuster() (cache), generateWebSocketKey() (websocket), and randomHex() (calibration) no longer fall back to time.Now().UnixNano() when crypto/rand fails — they now return errors instead of predictable values
  • Removed python/python3 from workflow command allowlist — prevented arbitrary code execution via workflow files
  • HTML report XSS hardening — safeHTML template function now escapes content with template.HTMLEscapeString before casting to template.HTML

Fixed

  • Partial body reads — replaced resp.Body.Read(buf) with io.ReadAll(io.LimitReader(...)) in cache and traversal packages to prevent truncated response data
  • OAuth/PKCE functions return errors — GenerateState(), GenerateNonce(), and GeneratePKCEPair() now return (string, error) / (string, string, error) instead of silently using weak fallbacks
  • URL mutation in NoSQL injection — testQueryParam now clones the URL via value copy to prevent shared pointer corruption across loop iterations
  • Case-sensitive severity scoring — scoring engine now normalizes severity to lowercase before lookup, fixing mismatches with "critical" vs "Critical"
  • SSRF false positives — isLocalResponse no longer treats any HTTP 200 as SSRF evidence; requires body content matching internal service patterns
  • SSTI false positives — baseline comparison added to analyzeResponse to skip math results and expected outputs already present in normal page content
  • Session fixation false positives — scanner now checks if server actually set a session cookie before flagging fixation vulnerability
  • IDOR false positives — testAccess now reads response body and checks for access-denied patterns in 200 responses; horizontal privilege test compares response bodies for similarity
  • Baseline capture timing — executor.go now captures detection baseline after body is read, ensuring accurate ContentLength
  • Request body replay on retry — POST request bodies are re-created on retry attempts in executor (readers are consumed after first use)
  • Silent ban detector — headerChanges counter resets on successful response to prevent monotonic accumulation causing false ban detections
  • Health monitor restart — stopCh channel recreated on Start() to allow proper Stop/Start cycling
  • Worker pool Submit on close — recover from send-on-closed-channel panic when Close() races with Submit(); ParallelFor compensates wg.Done() for failed submits
  • Crawler shutdown — replaced polling default case with atomic.Int64 in-flight counter for clean queue closure
  • DNS brute-force rate limiting — added QueryDelay config (default 50ms) to prevent DNS server throttling
  • SOCKS proxy fallback — explicit dialer initialization when SOCKS dialer creation fails (was silently nil)
  • Proxy dial timeout — fixed goroutine/connection leak by using channel-send-or-close pattern instead of select-after-send
  • TLS transport leaks — DisableKeepAlives=true and CloseIdleConnections() added to per-request JA3 and fallback transports
  • Checkpoint defensive copy — Load() returns deep copy of state to prevent external modification from racing with manager
  • Distributed coordinator — GetNodes(), GetTasks(), and GetTask() return deep copies to prevent callers from mutating internal state
  • History store — Get() and List() return deep copies of ScanRecord to prevent mutation of cached data
  • OOB detector timeout — CheckInteractions enforces 30-second context timeout to prevent hanging on unresponsive OOB servers
  • Recon error propagation — FullScan now returns aggregated errors via errors.Join instead of silently discarding them
  • Mutation executor streaming — StreamResults stats channel changed from synchronous return to buffered <-chan *ExecutionStats to prevent goroutine hangs
  • Runner context cancellation — RunWithCallback now waits for in-flight goroutines before returning on context cancellation

Improved

  • Concurrent map safety — added sync.RWMutex to encoder registry, metrics Calculator, evasion engine rng, and timing attack rng
  • Deterministic iteration — evasion engine List(), ListByCategory(), GenerateVariants(), and generateChains() now sort technique IDs for stable output
  • JWT algorithm confusion — expanded from RS256→HS256 only to all asymmetric algorithms (RS/ES/PS 256/384/512) → all HMAC variants
  • CSRF token detection — added _csrf, nonce, meta tag patterns, and X-CSRFToken header
  • Command injection payloads — added Windows pipe separator and 5 new output-based payloads (ipconfig, systeminfo, net user, echo pipe, tasklist)
  • Mass assignment parameters — added framework-specific parameters for Rails, Django, Spring, Laravel, and Node.js
  • LFI payloads — integrated null byte injection and Unicode/double-encoding payloads into main Payloads() function
  • HPP payload encoding — XSS and path traversal HPP payloads now use url.QueryEscape for proper encoding
  • XSS reflection detection — added NFKC Unicode normalization check for fullwidth character bypasses
  • GraphQL introspection retry — added backoff retry (3 attempts) for rate-limited or temporarily failing introspection queries
  • Upload size enforcement — TestUpload now checks payload size against MaxFileSize before building multipart request
  • Cloud discovery — added ProviderAkamai and ProviderOracle constants; fixed NewAzureClient parameter order
  • Rate limiter in WAF detection — detectWAF now calls a.limiter.Wait(ctx) before secondary probe request
  • WebSocket validation — CheckWebSocket and TestOriginValidation now verify Sec-WebSocket-Accept header per RFC 6455
  • Intelligence predictor — PredictBatch uses internal predictLocked() to avoid re-entrant RLock deadlock

Tests

  • Added 10 regression test files covering concurrency, URL mutation, crypto fallback, scoring, streaming, body reads, and workflow allowlist
  • Added 7 structural enforcement tests: crypto fallback, template HTML, body reads, math/rand in security paths, workflow allowlist, concurrent map access, HTTP body closure
  • Updated cache_test.go and websocket_test.go for new (string, error) signatures
  • Updated ssti_test.go for baseline parameter and adjusted MaxPayloads request count
  • Updated ssrf_test.go for stricter isLocalResponse body matching
  • Updated scoring_test.go for lowercase severity map keys and case-insensitive validation
  • Updated distributed_test.go to modify internal state directly instead of through defensive-copy getters
  • Cleared all structural test known-violation ratchet lists (17 violations → 0)

[2.7.0] - 2026-02-07

Added

Container Packaging — ghcr.io/waftester/waftester

  • Multi-architecture Docker image published to GitHub Container Registry

    • Multi-stage Dockerfile: golang:1.24-alpine build → distroless/static-debian12:nonroot runtime (~5 MB)
    • Native Go cross-compilation via TARGETARCH/TARGETOS (no QEMU emulation for build)
    • Multi-arch manifest: linux/amd64 + linux/arm64
    • BuildKit cache mounts for fast rebuilds (/go/pkg/mod, /root/.cache/go-build)
    • Attack payloads bundled in image — self-contained, no volume mounts required
    • MCP-specific OCI labels: io.modelcontextprotocol.server=true

  • Docker Compose for local development (docker-compose.yml)

    • Environment-substituted build args: ${VERSION:-dev}, ${COMMIT:-local}, ${BUILD_DATE:-}
    • Security hardening: read_only: true, tmpfs: /tmp:noexec,nosuid,size=64m, no-new-privileges:true
    • Port 8080 exposed, restart: unless-stopped

  • CI/CD workflow (.github/workflows/docker-publish.yml)

    • Triggered by workflow_run from CI (same gate pattern as release.yml) + PR direct trigger
    • Multi-arch build via QEMU + Docker Buildx
    • Semver tag strategy: 1.2.3, 1.2, 1, latest on tagged releases; edge on main; sha-* always
    • SBOM + provenance attestation on release images
    • GitHub Actions cache for layer reuse
    • All 5 Docker action SHAs pinned and verified: metadata-action v5.10.0, setup-qemu v3.7.0, setup-buildx v3.12.0, login v3.7.0, build-push v6.18.0

  • .dockerignore minimizes build context and prevents sensitive content leaks

    • Excludes .git, .github, .claude, IDE configs, tests, docs, build artifacts
    • Excludes payloads/premium/ and payloads/.cache/ to prevent licensed content from leaking into public images

MCP Server — AI-Native WAF Testing Interface

  • Enterprise MCP Server (pkg/mcpserver/): Model Context Protocol server enabling AI agents (Claude, GPT, Copilot) and automation platforms (n8n, Langflow) to control WAFtester programmatically

    • Full MCP 2025-03-26 specification compliance via Go SDK v1.2.0
    • Dual transport: Stdio for IDE integrations (VS Code, Claude Desktop, Cursor) + HTTP for remote/Docker deployments
    • Dual HTTP protocol: Streamable HTTP (/mcp) for modern clients + legacy SSE (/sse) for n8n and older MCP clients
    • CORS middleware for browser-based and cross-origin MCP clients
    • Health endpoint (/health) for Kubernetes/Docker readiness probes

  • 10 MCP Tools with opinionated descriptions optimized for LLM tool selection:

    ToolPurpose
    list_payloadsBrowse attack payload catalog with category/severity filtering
    detect_wafFingerprint WAF vendor, version, and CDN layers
    discoverMap attack surface from robots.txt, sitemap, JS, Wayback Machine
    learnGenerate intelligent test plans from discovery results
    scanExecute WAF bypass tests with curated payloads
    assessEnterprise assessment with F1, precision, MCC, FPR metrics
    mutateApply encoding/evasion transformations to payloads
    bypassSystematic bypass testing with mutation matrix
    probeTLS, HTTP/2, and technology fingerprinting
    generate_cicdGenerate CI/CD pipeline YAML (GitHub Actions, GitLab, Jenkins, Azure DevOps, CircleCI, Bitbucket)

  • 8 MCP Resources providing domain knowledge without network calls:

    • waftester://version — Server capabilities and tool inventory
    • waftester://payloads — Full payload catalog with category breakdown
    • waftester://payloads/{category} — Per-category payload listing (template)
    • waftester://guide — Comprehensive WAF testing methodology guide
    • waftester://waf-signatures — 12 WAF vendor signatures with bypass tips
    • waftester://evasion-techniques — Evasion encoding catalog with effectiveness ratings
    • waftester://owasp-mappings — OWASP Top 10 2021 category mappings with CWE references
    • waftester://config — Default configuration values and bounds

  • 5 MCP Prompts for guided workflow templates:

    • security_audit — Full security assessment workflow
    • waf_bypass — Targeted bypass hunting with stealth options
    • full_assessment — Enterprise assessment with statistical metrics
    • discovery_workflow — Attack surface mapping workflow
    • evasion_research — Payload evasion research and encoding

  • Comprehensive Server Instructions: 300+ line operating manual embedded in server that guides AI agents through tool selection, workflow orchestration, result interpretation, rate limiting, and error recovery

  • n8n Integration: Validated compatibility with n8n’s MCP Client node

    • SSE transport endpoint at /sse (2024-11-05 spec)
    • Bearer, Header, and OAuth2 authentication support via CORS headers
    • Tool filtering (All/Selected/All Except) works with tool annotations

MCP Server Infrastructure

  • CORS Middleware: Permissive cross-origin headers for browser-based clients

    • Origin echo (reflects request origin) with * fallback
    • Exposes Mcp-Session-Id header for session tracking
    • Allows Authorization, Mcp-Session-Id, Last-Event-ID headers
    • OPTIONS preflight with 24-hour cache (Max-Age: 86400)

  • Health Endpoint with Readiness: /health endpoint for container orchestrators

    • Returns 503 {"status":"starting"} during startup validation
    • Transitions to 200 {"status":"ok"} after MarkReady() (payload dir validated)
    • Method-restricted to GET/HEAD (returns 405 for other methods)
    • JSON content type with proper CORS headers

  • Startup Payload Validation: Server validates payload directory at startup before accepting connections

    • Checks directory exists, loads all payloads via payloads.NewLoader()
    • Logs payload count on success; exits with hint on failure
    • Prevents silent operation with missing/corrupted payload data

  • Environment Variable Support: Docker/Kubernetes-friendly configuration

    • WAF_TESTER_PAYLOAD_DIR — override payload directory path
    • WAF_TESTER_HTTP_ADDR — set HTTP listen address (alternative to --http flag)

  • HTTP Server Hardening: Production-grade HTTP server configuration

    • ReadHeaderTimeout: 10s — prevents slowloris attacks
    • ReadTimeout: 30s, WriteTimeout: 60s, IdleTimeout: 120s
    • MaxHeaderBytes: 1MB — limits header memory allocation

  • Graceful Shutdown: Clean shutdown on SIGINT/SIGTERM

    • 15-second drain period for in-flight requests before forceful close
    • Logs shutdown progress to stderr

  • Progress Notifications: Tools report notifyProgress() with percentage and status messages during long-running operations (scan, assess, bypass)

  • Structured Logging: Tools emit logToSession() events with typed mcp.LoggingLevel constants for real-time operation visibility

Fixed

  • P0 Data Race in Scan Tool: received and bypasses counters in handleScan were bare int accessed from concurrent goroutines in the OnResult callback — replaced with sync/atomic.Int64
  • Logging Level Type Safety: The MCP SDK defines LoggingLevel as type string with no exported constants — defined typed logInfo/logWarning constants to prevent raw string errors
  • Scan Tool Missing Annotations: Added ReadOnlyHint and IdempotentHint to scan tool annotations (both false)
  • WAF Signatures Count Mismatch: total_signatures was 25 but only 12 entries defined — corrected to 12
  • Target URL Validation: All 6 network tools (detect_waf, discover, scan, assess, bypass, probe) now validate URL scheme (http/https only) and host before making requests — prevents confusing errors from malformed URLs
  • json.MarshalIndent Error Handling: 5 resource handlers silently discarded marshal errors (data, _ :=) — all now use data, err := and return fmt.Errorf(...) on failure
  • User-Agent Hardcoded String: Replaced hardcoded "waf-tester/probe" in probe tool with defaults.UserAgent("probe") to match centralized UA management
  • Response Body Drain: Probe tool now drains up to 4KB before closing response body (io.Copy(io.Discard, io.LimitReader(resp.Body, 4096))) to allow HTTP connection reuse
  • WAF Vendor List Accuracy: Version resource updated from 25 inaccurate vendor names to 26 actual WAF vendors matching the detection code; added supported_cdn_vendors field with 9 CDN entries
  • Server Instructions Accuracy: Corrected payload count to “2,800+” and signature count to “26 WAF + 9 CDN detection signatures”; fixed waf-signatures resource reference from 26 to 12 entries
  • Bypass Tool Error Messages: Empty target error now includes example JSON with both target and payloads fields, matching other tool error patterns

Removed

  • Unused SessionTimeout Config Field: Removed from Config struct along with unused time import

Tests

  • 44 tests covering full MCP protocol surface:
    • Server creation (2): nil safety, default config
    • Tool registration (3): count, descriptions, annotations
    • Resource registration (2): static resources, template resources
    • Resource content (7): version, guide, WAF signatures, evasion techniques, OWASP mappings, config, payloads
    • Prompt registration (2): count, arguments
    • Prompt invocation (4): security_audit, waf_bypass, evasion_research, missing target
    • Tool invocation (5): list_payloads, list_payloads with filter, mutate, generate_cicd, generate_cicd all platforms (6 subtests)
    • Target URL validation (3): empty target rejection across all 6 network tools (6 subtests), invalid scheme rejection (ftp://), missing scheme rejection (bare hostname)
    • Hook tests (2): event bridge, nil callback
    • Server capabilities (1): initialization result validation
    • Edge cases (3): nonexistent tool/resource/prompt
    • HTTP transport (2): HTTPHandler, SSEHandler return non-nil
    • Health endpoint (3): 200 OK when ready, 503 Service Unavailable when not ready, 405 for invalid methods
    • CORS (3): headers with origin echo, preflight OPTIONS, default origin fallback
    • Data consistency (2): WAF signatures count matches entries, scan annotations complete

[2.6.8] - 2026-02-06

Added

New Output Formats

  • XML Export (--xml): Legacy XML format for enterprise SIEM/vulnerability management platforms
    • DTD-style structure with full compliance mapping (CWE, OWASP, WASC)
    • Auto-populated WASC IDs via defaults.GetWASCID() mapping

New Integrations

  • Elasticsearch SIEM Integration (--elasticsearch-url): Stream results to Elasticsearch

    • Bulk API support for high-throughput indexing
    • API key and basic auth support (--elasticsearch-api-key, --elasticsearch-username)
    • TLS skip verify option (--elasticsearch-insecure) for self-signed certs

  • GitHub Issues Integration (--github-issues-token): Auto-create issues from bypasses

    • Creates formatted markdown issues with CWE links and severity labels
    • Configurable via --github-issues-owner and --github-issues-repo

  • Azure DevOps Integration (--ado-org, --ado-project, --ado-pat): Auto-create work items from bypasses

    • Creates formatted HTML work items with severity/priority mapping
    • Supports Bug, Task, Issue work item types via --ado-work-item-type
    • Optional area path (--ado-area-path) and iteration path (--ado-iteration-path)
    • Includes repro steps with curl commands when available

  • Historical Scan Storage (--history-path): JSON-based scan history for trend analysis

    • Stores detection rates, grades, category scores, latency metrics
    • Enables scan comparison and regression detection
    • Tag scans with --history-tags for organization

Report Customization

  • Template Configuration (--template-config): YAML-based report customization
    • Pre-built templates: minimal.yaml (executive summary), enterprise.yaml (full audit)
    • Customize branding (logo, colors, company name)
    • Enable/disable sections (charts, metrics, compliance mapping)
    • Theme selection (light/dark/auto), print optimization

Fixed

  • Missing CLI Wiring: XML export, Elasticsearch, History, and Template Config flags were defined in output.Config/BuildDispatcher but never exposed via CLI flags — all 4 features are now fully wired into all 6 Register* variants with ToConfig() mapping
  • Elasticsearch Unbounded Read: io.ReadAll(resp.Body) on error paths replaced with io.LimitReader(resp.Body, 4096) to prevent memory exhaustion from malicious servers
  • Elasticsearch Double-Flush Race: Write() now drains buffer inside the lock before calling bulkInsert(), eliminating concurrent redundant HTTP calls
  • Template Config OR-Logic Bug: mergeSectionConfig() used OR logic (base || override), making it impossible for minimal template to disable sections — now uses override values directly
  • Template ValidateConfig Silent Fix: ValidateConfig() silently corrected invalid values instead of returning errors — now returns descriptive validation errors
  • History Store Crash Corruption: saveIndex() now uses atomic write (temp file + os.Rename) to prevent data loss if process crashes mid-write
  • History ListAll Time Bound: ListAll()/GetLatest() used time.Now().Add(24h) as upper bound — replaced with time.Date(9999,...) sentinel to handle clock drift
  • Raw http.Client Usage: Elasticsearch and GitHub Issues now use httpclient.New() for proper timeouts and TLS config
  • WASC Mapping Unused: XML writer now populates WASC field from category mapping

Changed

  • Custom itoa() Removed: Replaced hand-rolled 22-line itoa() in XML writer with strconv.Itoa
  • Custom escapeHTML() Removed: Replaced custom HTML escaping in Azure DevOps hook with stdlib html.EscapeString
  • WASCOrdered Immutable: Converted from mutable var []string to function returning a defensive copy
  • MergeConfig Expanded: Template config merging now handles all fields including Sections, Styling, and Export settings
  • Release Packaging: Template configs now included in release archives

Removed

  • Duplicate Code: Deleted ~800 lines of dead code in pkg/integrations/ (duplicated hooks/jira.go and hooks/slack.go)

[2.6.7] - 2026-02-05

Added

High-Performance JSON Package

  • New pkg/jsonutil Package: Drop-in replacement for encoding/json using github.com/go-json-experiment/json
    • 2-3x faster JSON marshaling/unmarshaling in hot paths
    • Compatible API: Unmarshal, Marshal, MarshalIndent, NewStreamEncoder, NewStreamDecoder
    • Streaming encoder with SetIndent() support matching encoding/json behavior
    • Comprehensive test suite with benchmarks

Structural Enforcement Tests

  • TestHotPathsUseJsonutil: Verifies 8 hot path files use jsonutil instead of encoding/json
  • TestUploadUsesBufferPool: Ensures upload.go uses bufpool.Get()/Put() for buffer management
  • TestJsonutilPackageExists: Validates jsonutil has all required functions
  • TestSlicePreallocationInHotPaths: Enforces minimum pre-allocated slices in hot paths
  • TestGoreleaserHasTrimpath: Ensures .goreleaser.yaml includes -trimpath flag

Changed

Performance Optimizations

  • Build Optimization: Added -trimpath flag to goreleaser for smaller, reproducible binaries
  • Payload Loading: Migrated pkg/payloads/loader.go and database.go to fast JSON
  • Output Writers: Migrated json.go, jsonl.go, sarif.go, html.go to jsonutil
  • Export Builder: Migrated all 7 encoder sites in builder.go to jsonutil
  • Upload Package: Now uses bufpool for multipart buffer allocation + jsonutil for JSON

Memory Allocation Improvements

  • Slice Pre-allocation: Added capacity hints to reduce allocations:
    • pkg/payloads/loader.go: allPayloads := make([]Payload, 0, 2048)
    • pkg/xss/xss.go: 6 pre-allocated slices in hot functions
    • pkg/xxe/xxe.go: 4 pre-allocated slices in payload generation

Technical Details

  • Package test coverage increased from 98.5% to 99.2% (132/133 packages)
  • All 146 packages pass tests
  • Binary size with optimizations: ~25.7 MB (with -trimpath -s -w)

[2.6.6] - 2026-02-05

Fixed

Critical Security Fixes

  • OAuth Predictable Tokens: GenerateState(), GenerateNonce(), GeneratePKCEPair() now use crypto/rand instead of deterministic patterns - prevents CSRF and token hijacking attacks

High Priority Fixes

  • Checkpoint Double-Counting: Fixed MarkCompleted() counting same target multiple times
  • Checkpoint Data Race: Added mutex lock in GetProgress() before reading CompletedTargets
  • Checkpoint State Leak: GetState() now returns defensive copy with deep-copied maps
  • Goroutine/Connection Leak: Fixed TimeoutDialer.DialContext() in proxy.go - now checks context cancellation after dial
  • SSTI rand.Int Nil Panic: Added error check with fallback values in randomMathValues()
  • SSTI Defer in Loop: Replaced defer with immediate close to prevent connection exhaustion
  • OpenAPI http.Get Timeout: ParseURL() now uses context with 30s timeout - prevents hanging on slow servers
  • SOAP Client No Context: Added CallWithContext() with timeout/cancellation support

Medium Priority Fixes

  • TOCTOU Race: Fixed race condition in hosterrors.MarkError() - all state modifications now under single lock
  • Detector.Clear Incomplete: Now also calls connMon.Clear() to prevent stale connection data
  • WorkerPool Map/Filter Hang: Added wg.Done() compensation when Submit() fails
  • WorkerPool Panic Respawn: Worker now respawns after panic recovery
  • WorkerPool CAS Race: Emergency worker spawning uses atomic CAS instead of check-then-increment
  • RateLimiter Missing Clear: Added ClearHost() and ClearAllHosts() methods
  • WAF Strategy Cache Leak: Added TTL-based eviction and max size limit (1000 entries, 30min TTL)
  • SSRF Callbacks Leak: Added ClearCallbacks() and CleanupExpiredCallbacks(maxAge) methods
  • OOB Payloads Leak: Added ClearPayloads() and CleanupExpiredPayloads(maxAge) methods
  • BatchCapturer Goroutine Leak: Stop() now drains channels to unblock workers
  • Recursive Fuzzer Leak: Added ClearVisited() and Reset() methods for memory management
  • Discovery Maps Nil Panic: Initialize discoveredSecrets, discoveredS3Buckets, discoveredSubdomains in constructor
  • WildcardDetector Nil Check: Added nil check before calling AddBaseline()
  • AI Context Cancellation: generateWithMutationsCtx() now respects context cancellation
  • Gzip Reader Defer: Use defer for gzip reader close - panic-safe resource cleanup
  • Wordlist Bounds Check: generateNumeric() validates max > min and caps at 10M entries
  • Smuggling Unbounded Copy: Added 10MB limit to io.Copy from network socket
  • DNS Context Leak: Added defer cancel() after context.WithCancel()
  • NoSQL Body Close: Use defer for response body close - panic-safe cleanup
  • TLS Redundant Mutex: Removed unnecessary lock/unlock for already-captured profile variable

Low Priority Fixes

  • Runner Zero Burst: Added if burst < 1 { burst = 1 } to prevent division by zero
  • apiabuse String Bug: Fixed string(rune(requests)) to fmt.Sprintf("%d", requests)
  • DNS Loop Variable Capture: Capture resolver variable explicitly in closure

Performance Improvements

  • Fuzzer Buffer Pooling: Use bufpool.GetSlice() for body read buffers - reduces GC pressure
  • Fuzzer Byte-Based Counting: countWords() and line counting operate on bytes, not strings
  • Fuzzer needsBodyString(): Avoid string conversion when not needed
  • Runner Host Cache: Added sync.Map cache for URL host extraction - eliminates repeated parsing
  • RateLimiter Atomic Time: Changed lastRequest from time.Time to atomic int64 nanoseconds
  • RateLimiter Reusable Timer: Replaced time.After() allocations with reusable timer pattern
  • SQLi Quick-Check Filter: containsSQLKeyword() fast-path avoids regex on non-SQL responses
  • JSHexEncoder O(n): Fixed O(n²) decode loop using strconv.ParseUint and strings.Builder

Improved Error Handling

  • rand.Read Fallbacks: All rand.Read() calls now check errors and provide time-based fallbacks:
    • pkg/websocket/websocket.go: generateWebSocketKey()
    • pkg/cache/cache.go: generateCacheBuster()
    • pkg/realistic/calibration.go: randomHex()
    • pkg/jwt/jwt.go: Random signature generation
    • pkg/probes/jarm.go: JARM probe random bytes

[2.6.5] - 2026-02-06

Added

  • Advanced Cognitive Modules (pkg/intelligence/): 5 new learning subsystems for intelligent WAF analysis

    • Bypass Predictor: Predicts bypass probability before testing using learned patterns from:
      • Category success rates (SQLi, XSS, CMDI, etc.)
      • Encoding effectiveness (URL, Unicode, Hex, HTML entity)
      • Endpoint pattern recognition
      • Technology-specific vulnerabilities
    • Mutation Strategist: Suggests specific mutations when blocked, learns which bypass techniques work for specific WAF patterns
      • Built-in knowledge for Cloudflare, AWS WAF, Akamai, ModSecurity, Imperva, F5
      • Tracks encoding effectiveness and category-specific mutations
    • Endpoint Clusterer: Groups similar endpoints to optimize testing order
      • Reduces redundant testing on similar endpoints
      • Infers behavior from cluster representatives
      • Suggests optimal testing order based on cluster analysis
    • Anomaly Detector: Detects honeypots, silent bans, behavior shifts
      • Baseline calibration for normal server behavior
      • Rate limiting detection with automatic backoff
      • Honeypot detection (too-good-to-be-true bypass rates)
      • Silent ban detection (sudden behavior changes)
    • Attack Path Optimizer: Finds optimal paths through vulnerability chains
      • Graph-based attack modeling with escalation paths
      • Prioritizes high-value targets (RCE > SQLi > XSS)
      • Node pruning for memory-efficient large scans

  • WAF Profiler Integration: Enhanced WAF fingerprinting with behavioral learning

    • Tracks bypass effectiveness by attack category
    • Records encoding success rates for targeted mutations
    • Latency analysis for blocked vs. bypassed requests
    • Automatic weakness/strength detection
    • Integrated with Engine for real-time profiling

  • Persistence Layer: Save and resume brain state across sessions

    • Engine.Save(path) / Engine.Load(path) for file-based persistence
    • Engine.ExportJSON() / Engine.ImportJSON() for programmatic access
    • Engine.Reset() clears all learned state
    • Per-module Export/Import/Reset for granular control

  • Observability Metrics: Performance tracking for intelligence operations

    • Findings processed/blocked/bypassed counters
    • Prediction accuracy tracking
    • Mutation success rate monitoring
    • Memory eviction tracking
    • Save/Load operation counters

  • Configuration System: Centralized configuration for all modules

    • PredictorConfig, MutatorConfig, ClustererConfig, AnomalyConfig
    • PathfinderConfig with BFS depth limits and category values
    • MemoryConfig with eviction policies
    • DefaultXxxConfig() factory functions for sensible defaults

Changed

  • Memory Management: LRU eviction prevents unbounded memory growth

    • Default limit: 10,000 findings
    • Evicts oldest 10% when capacity reached
    • Configurable via Memory.SetMaxFindings()

  • BFS Pathfinding: Added safety limits to prevent resource exhaustion

    • Configurable depth limit (default: 10)
    • Queue size limit (10,000 items) prevents memory exhaustion
    • Node pruning removes low-value paths

  • Empty Slice Returns: Methods now return empty slices instead of nil

    • Memory.GetByCategory(), Memory.GetByPhase() return [] not nil
    • Safer for callers, no nil checks required

Fixed

  • Data Loss Bug: Memory.Import() now preserves category priorities
  • StatusCode Bug: Fixed extractBlockSignature() using incorrect string conversion
    • Was: string(rune(statusCode)) → garbage output
    • Now: fmt.Sprintf("%d", statusCode) → correct “403” output
  • Thread Safety: Added mutex locks to callback setters (OnInsight, OnChain, OnAnomaly)
  • Nil Pointer: Added nil checks in feedAdvancedModules() and AddNode()
  • formatPct: Simplified overly complex percentage formatting function

[2.6.4] - 2026-02-05

Added

  • Brain Mode (pkg/intelligence/): 🧠 Transform auto mode from “automated sequencing” to “adaptive reasoning”

    • Learning Memory: Stores all findings with indexing by category, phase, and path for cross-phase correlation
    • WAF Behavioral Model: Learns WAF patterns (block rates, weaknesses, strengths) to adapt attack strategies
    • Technology Profiling: Auto-detects frameworks, databases, servers, and languages to inform payload selection
    • Attack Chain Building: Combines low-severity findings into high-impact compound attacks:
      • Secret + Auth chains (leaked credentials + authentication endpoints)
      • Leaky Path + Parameter chains (exposed paths + injectable parameters)
      • Pattern Exploitation chains (consistent bypass patterns across endpoints)
      • SSRF + Cloud chains (SSRF vulnerabilities + cloud metadata endpoints)
      • XSS + DOM chains (XSS vulnerabilities + DOM sinks)
      • SQLi + Auth Bypass chains (SQL injection + authentication bypass)
    • Smart Payload Recommendations: Prioritizes payloads based on technology fingerprinting and bypass history
    • Resource Optimization: Allocates testing resources to most promising attack vectors
    • Real-Time Insights: Generates actionable insights during scan (bypass clusters, weak WAF rules, high-value endpoints)
    • New flags: --brain (enabled by default), --brain-verbose
    • Brain summary displayed before final report with top weaknesses, chains, and recommendations

  • Enhanced Auto Mode Intelligence:

    • Auto-Resume: Interrupted auto scans can now be resumed from the last checkpoint using --resume flag
    • Auto-Report Multi-Format: Generates multiple report formats using --report-formats flag (supports json, md, html, sarif)
    • Auto-Escalation: Automatically reduces rate and concurrency when connection drops, silent bans, or HTTP 429 responses are detected
    • Auto-Rate Adjustment: Integrates adaptive rate limiting from pkg/ratelimit to dynamically adjust request rate based on WAF response

  • SARIF Report Generation:

    • New SARIF 2.1.0 format output for CI/CD integration (GitHub Code Scanning, Azure DevOps)
    • Use --report-formats sarif or --report-formats json,md,html,sarif for multi-format output
    • SARIF reports include bypass severity scores, endpoint locations, and reproducible curl commands

  • New Auto Mode Flags:

    • --resume: Resume a previously interrupted auto scan from checkpoint
    • --checkpoint <file>: Custom checkpoint file path (default: <workspace>/checkpoint.json)
    • --report-formats <list>: Comma-separated output formats (default: json,md,html)
    • --adaptive-rate: Enable dynamic rate adjustment based on WAF response (default: true)

  • Auto Mode Checkpoint Integration (pkg/checkpoint/):

    • Auto mode now saves progress after each phase completion
    • Checkpoint file stored in workspace directory as checkpoint.json
    • Supports resumption from discovery, JS analysis, parameter discovery, and WAF testing phases

  • Detection-Triggered Auto-Escalation:

    • Registers callbacks with pkg/detection to automatically respond to:
      • Connection drops (3+ consecutive drops trigger escalation)
      • Silent bans (WAF behavioral changes trigger escalation)
      • HTTP 429 Too Many Requests responses
    • Escalation reduces rate by 50% and concurrency by 50% (floors: rate=10, concurrency=5)
    • Maximum 5 escalation events per scan to prevent stalling

Changed

  • Documentation Overhaul:

    • Complete README.md rewrite with enterprise-grade structure and professional presentation
    • Reorganized content following industry best practices (Nuclei, Trivy, httpx patterns)
    • Added problem/solution narrative explaining WAFtester’s value proposition
    • Enhanced comparison tables with detailed feature breakdowns
    • Removed all emojis for enterprise consistency

  • Examples Guide Enhancement (docs/EXAMPLES.md):

    • Added detailed “When to Use” guidance for all core commands
    • Expanded command descriptions with business context and value propositions
    • Added interpretation guidance for assessment metrics
    • Included expected output descriptions for each command category
    • Structured examples by use case with recommendation tables

Fixed

  • Auto mode progress display correctly updates phase count during multi-format report generation
  • Executor uses current adaptive rate values instead of initial flag values

[2.6.3] - 2026-02-04

Added

  • Comprehensive Proxy & SNI Support (pkg/httpclient/):

    • SOCKS4/SOCKS5/SOCKS5h Proxy Support: Full compatibility with all major SOCKS proxy protocols
    • SNI Override (--sni): Override TLS ServerName for CDN bypass and origin testing
    • Replay Proxy (--replay-proxy/-rp): Duplicate traffic to security tools like Burp Suite
    • Burp Suite Shortcut (--burp): Automatically configures proxy to 127.0.0.1:8080
    • ZAP Shortcut (--zap): Automatically configures proxy to 127.0.0.1:8081
    • DNS-over-Proxy (socks5h://): Route DNS lookups through SOCKS5 proxy for enhanced anonymity
    • Timeout Dialer: Configurable connection timeouts for SOCKS proxies (matches fastdialer pattern)

  • New CLI Flags:

    • --sni <hostname>: Override TLS SNI for origin server testing behind CDN/WAF
    • --replay-proxy <url> / -rp <url>: Send duplicate requests to security proxy
    • --burp: Shortcut for --proxy http://127.0.0.1:8080 (Burp Suite default)
    • --zap: Shortcut for --proxy http://127.0.0.1:8081 (OWASP ZAP default)

  • HTTP Client Enhancements (pkg/httpclient/):

    • proxy.go: New module for proxy URL parsing, validation, and SOCKS dialer creation
    • ParseProxyURL(): Parse and validate proxy URLs with scheme-aware default ports
    • CreateSOCKSDialer(): Create SOCKS4/5/5h dialers with authentication support
    • ValidateProxyURL(): Validate proxy URLs support (http, https, socks4, socks5, socks5h)
    • TimeoutDialer: Wrapper for proxied connections with configurable timeouts
    • WithSNI(), WithProxyAndSNI(), WithBurp(), WithZAP(): Convenience functions

  • Output Enhancements:

    • Proxy, ReplayProxy, and SNI fields added to JSON output metadata
    • Streaming events include proxy/SNI configuration in scan config
    • Enhanced JSON output includes full execution metadata with proxy settings

  • Competitive Parity: Feature matching with industry-leading tools

    • Matches nuclei: HTTP/SOCKS5 proxy, proxy-all, SNI passthrough
    • Matches ffuf: replay-proxy for Burp integration
    • Matches feroxbuster: —burp shortcut convenience
    • Matches httpx: sni parameter for TLS override
    • Exceeds many competitors: socks5h DNS-over-proxy support

Changed

  • Updated pkg/httpclient/httpclient.go Config struct with SNI, ReplayProxy, ProxyDNS fields
  • Updated pkg/config/config.go with new proxy/SNI CLI flag definitions
  • Updated pkg/output/events/start.go ScanConfig with proxy metadata
  • Updated pkg/output/enhanced.go ExecutionMetadata with proxy/SNI fields

Tests

  • Added comprehensive proxy test suite (pkg/httpclient/proxy_test.go):
    • ParseProxyURL: 12 test cases covering all supported schemes and edge cases
    • ProxyConfigAddress, ProxyConfigAuth, ProxyConfigDNSRemote tests
    • ValidateProxyURL tests for scheme validation
    • TimeoutDialer context timeout behavior tests
    • BurpProxyURL and ZAPProxyURL constant validation

[2.6.2] - 2026-02-04

Added

  • 7 New CLI Commands: Wire orphaned packages to CLI for full feature access

    • template / nuclei: Nuclei-compatible YAML template scanner
    • grpc / grpc-test: gRPC service testing via reflection
    • soap / wsdl: SOAP/WSDL service testing and fuzzing
    • openapi / swagger: OpenAPI specification security fuzzing
    • cicd / pipeline: CI/CD pipeline configuration generator
    • plugin / plugins: Plugin management system
    • cloud / cloud-discover: Cloud resource discovery (AWS, Azure, GCP)

  • Package Enhancements:

    • pkg/nuclei: Added FilterOptions struct and LoadDirectory() for recursive template loading
    • pkg/cloud: Added ResourceType constants, Discoverer, DiscovererConfig, DiscoveryRequest, DiscoveryResults
    • pkg/grpc: Added InvokeMethod() for raw gRPC invocation with service/method parsing
    • pkg/openapi: Added ParseFromFile(), ParseFromURL() convenience functions
    • pkg/openapi: Added TestGenerator, GeneratorOptions, GeneratedTestCase, ExecuteFuzzTest()
    • pkg/plugin: Added LoadBuiltins(), LoadFromDirectory(), IsBuiltin(), GetPluginInfo()
    • pkg/soap: Added FetchAndParseWSDL(), GetOperations() for WSDL parsing
    • pkg/ui: Added ANSI color constants (Reset, Bold, Red, Green, Yellow, Blue, Magenta, Cyan, White, BoldRed)

  • Documentation:

    • docs/STRUCTURAL_ANALYSIS_REPORT.md: Comprehensive codebase analysis report
    • Updated CLI usage documentation with new API & Protocol Testing section

Fixed

  • Duplicate Function Resolution (pkg/nuclei/nuclei.go):

    • Removed duplicate FilterTemplates() function, kept new FilterOptions-based version
    • Added missing filepath import for directory walking

  • Package Interface Corrections:

    • Fixed cmd_plugin.go to handle two-value manager.Get() return
    • Fixed pkg/soap/client.go to use duration.HTTPFuzzing instead of hardcoded timeout

  • Test Fixes:

    • Updated pkg/nuclei/nuclei_test.go to use new FilterOptions signature

Changed

  • Updated cmd/cli/main.go with 7 new command switch cases
  • Updated cmd/cli/cmd_docs.go with new API & Protocol Testing section

[2.6.1] - 2026-02-04

Added

  • io_uring Support for Linux 5.1+ (pkg/iouring/): Zero-copy async I/O

    • iouring_linux.go: Full io_uring implementation with submission/completion queues
    • iouring_stub.go: Cross-platform stub for non-Linux systems
    • Supported(): Runtime detection of io_uring availability
    • Read()/Write(): Async file descriptor operations
    • Expected 2-5x throughput improvement on supported kernels

  • Platform-Specific Socket Optimizations (pkg/sockopt/): High-performance networking

    • sockopt_linux.go: Linux socket tuning (TCP_NODELAY, 256KB buffers, TCP_QUICKACK)
    • sockopt_stub.go: No-op stub for other platforms
    • OptimizeConn(): Apply optimizations to existing connections
    • DialControl(): Pre-apply optimizations during dial
    • 10-20% latency reduction on Linux

  • HTTP Client Socket Integration (pkg/httpclient/httpclient.go):

    • Integrated sockopt.OptimizeConn() for DNS-cached connections
    • Integrated sockopt.DialControl() for standard dialer
    • Automatic platform-specific optimization on all HTTP requests

  • New Tests: 10 additional tests for new packages

    • TestRingEmptyBuffer: Empty/nil buffer handling for io_uring
    • TestResponseReadFromReader: Reader-based response pooling
    • TestResponseReadFromReaderNil: Nil reader handling
    • TestResponseReadFromLimited: Size-limited response reading
    • TestPool_Go: Worker pool Go() alias verification
    • TestPool_Waiting: Worker pool queue depth verification

Fixed

  • Nil Pointer Prevention (pkg/sockopt/sockopt_linux.go):

    • Added nil check in OptimizeConn() to prevent panic on nil connections

  • Empty Buffer Safety (pkg/iouring/iouring_linux.go):

    • Added len(buf) == 0 check in Read() to prevent index out of bounds
    • Added len(buf) == 0 check in Write() to prevent index out of bounds

Technical Details

  • Build verification: go build ./... passes
  • All 65 performance-related tests pass
  • Lint verification: golangci-lint run clean
  • Phase 4 of Performance Optimization Plan complete

[2.6.0] - 2026-02-04

Added

  • WAF Strategy Test Suite (pkg/waf/strategy/strategy_test.go): 55 comprehensive tests
    • TestNewStrategyEngine_* - engine initialization tests
    • TestBuildStrategy_* - strategy building for all WAF vendors
    • TestPipeline_* - tamper pipeline execution tests
    • TestRateLimiting_* - WAF-aware rate limit configuration
    • TestTamperIntegration_* - tamper chain integration tests
    • TestConcurrencySafety_* - thread-safe strategy access

Changed

  • Massive CLI Architecture Refactoring: Split cmd/cli/main.go from 14,962 → 348 lines (97.7% reduction)
    • Created 14 focused command files for better maintainability:
      • cmd_scan.go (2,553 lines) - vulnerability scanning command
      • cmd_autoscan.go (2,114 lines) - automatic WAF testing command
      • cmd_probe.go (3,424 lines) - protocol probing (httpx-compatible)
      • cmd_docs.go (1,269 lines) - all documentation printing functions
      • cmd_misc.go (824 lines) - smuggle, race, workflow, headless commands
      • cmd_fuzz.go (649 lines) - content fuzzing command
      • cmd_tests.go (543 lines) - WAF testing workflow command
      • cmd_mutate.go (505 lines) - payload mutation command
      • cmd_crawl.go (419 lines) - web crawling command
      • cmd_admin.go (382 lines) - validate, update, report commands
      • cmd_bypass.go (315 lines) - WAF bypass discovery command
      • cmd_analyze.go (263 lines) - response analysis command
      • cmd_discover.go (243 lines) - endpoint discovery command
      • cmd_learn.go (178 lines) - WAF behavior learning command

Fixed

  • Flaky Test Fix (pkg/evasion/advanced/tampers/tampers_test.go): Fixed TestChainByPriority_RespectsOrder

    • Replaced non-deterministic modsecurityversioned tamper with deterministic base64encode and unmagicquotes
    • Test now reliably verifies priority ordering (Priority 0 before Priority 100)

  • Security Hardening (pkg/workflow/workflow.go): Command injection prevention

    • Added isAllowedExternalCommand() with strict allowlist (echo, cat, grep, curl, nuclei, python, etc.)
    • Added validateFilePath() for path traversal protection
    • Blocks .., absolute paths, and suspicious patterns

  • Cryptographic Randomness: Replaced insecure math/rand with crypto/rand

    • pkg/tls/ja3.go: Fixed 3 occurrences of random JA3 fingerprint generation
    • pkg/ssrf/ssrf.go: Fixed random ID generation for SSRF probes

Removed

  • Duplicate Packages: Deleted 3 redundant packages to reduce codebase confusion
    • pkg/businesslogic/ - duplicate of pkg/bizlogic/
    • pkg/insecuredeser/ - duplicate of pkg/deserialize/
    • pkg/openredirect/ - duplicate of pkg/redirect/

Technical Details

  • Updated cmd/cli/dispatcher_wiring_test.go to scan all new command files
  • All dispatcher wiring tests pass with new file structure
  • Build verification: go build ./... passes
  • Test verification: All CLI and structural tests pass

[2.5.3] - 2026-02-03

Added

  • Comprehensive Test Coverage Initiative: 127 new tests bringing total from 3,321 to 3,448

  • Dispatcher Unit Tests (pkg/output/dispatcher/dispatcher_test.go): 26 new tests

    • TestNew_DefaultBatchSize, TestNew_CustomBatchSize - configuration tests
    • TestDispatch_ConcurrentSafe - race-safe with 10 goroutines × 100 events
    • TestWriterFailure_OthersStillReceive - failure isolation verification
    • TestAsyncHooks_NonBlocking vs TestSyncHooks_Blocking - hook behavior
    • TestRegisterDuringDispatch_Race - concurrent registration safety
    • Thread-safe mockWriter/mockHook helpers with atomic counters

  • Core Race Tests (pkg/core/race_test.go): 5 new tests

    • TestExecutor_ConcurrentExecuteTest - 50 payloads from multiple goroutines
    • TestExecutor_SharedHTTPClient_Race - 100 goroutines × 5 requests
    • TestExecutor_RateLimiter_Race - concurrent rate limit checks
    • TestExecutor_Execute_Race - full worker pool under load
    • TestExecutor_OnResultCallback_Race - callback thread safety

  • Evasion Package Tests (pkg/evasion/advanced/tampers/tampers_test.go): 11 new tests

    • TestGetAllTampers_NotEmpty - verifies 68 tampers registered
    • TestTamper_Apply_Transforms - verifies transformation behavior
    • TestTamper_ConcurrentApply - 50 goroutines × 100 iterations
    • TestTamperChain_AppliesInOrder - chain ordering verification

  • Missing Package Tests: 53 new tests across 4 packages

    • pkg/leakypaths/leakypaths_test.go - 10 tests for path detection
    • pkg/params/params_test.go - 12 tests for parameter handling
    • pkg/recon/recon_test.go - 11 tests for reconnaissance
    • pkg/tls/tls_test.go - 20 tests for TLS/JA3 fingerprinting

  • Mutation Concurrent Tests (pkg/mutation/registry_test.go): 3 new tests

    • TestRegistry_ConcurrentMutateWithAll - 50 parallel goroutines
    • TestRegistry_ConcurrentRegisterAndMutate - concurrent ops
    • TestChainMutate_ConcurrentChains - parallel chain execution

  • Multi-Writer Integration Tests (pkg/output/integration_test.go): 2 new tests

    • TestMultiWriterScenario_JSONAndSARIF - dual format output
    • TestMultiWriterScenario_AllFormats - json, sarif, csv, md, html

  • Runner Race Tests (pkg/runner/runner_test.go): 4 new tests

    • TestRunner_Run_ConcurrentStatsUpdate - stats consistency under load
    • TestRunner_Run_CallbackRace - thread-safe callbacks
    • TestRunner_HighConcurrency - 100 targets × 50 workers
    • TestRunner_RunWithCallback_ConcurrentRace - streaming callbacks

  • Hook Contract Tests (pkg/output/hooks/hooks_test.go): 6 new tests

    • TestAllHooks_ImplementInterface - compile-time checks
    • TestSlackHook_RetryBehavior - 5xx retry verification
    • TestTeamsHook_Timeout - timeout handling
    • TestPrometheusHook_MetricsExport - 7 core metrics
    • TestOtelHook_SpanCreation - trace span verification

  • Event Flow Tests (pkg/output/events/events_test.go): 4 new tests

    • TestEvent_ConcurrentJSON_Race - 100 goroutines marshaling
    • TestResultEvent_ConcurrentAccess - parallel field reads
    • TestBypassEvent_ConcurrentAccess - parallel field reads
    • TestSummaryEvent_ConcurrentAccess - parallel field reads

  • Checkpoint Race Tests (pkg/checkpoint/checkpoint_test.go): 5 new tests

    • TestCheckpoint_ConcurrentMarkAndCheck - parallel operations
    • TestCheckpoint_ConcurrentSave - parallel save operations
    • TestCheckpoint_RapidUpdates - rapid mixed operations
    • TestCheckpoint_ConcurrentLoad - concurrent file access
    • TestCheckpoint_ConcurrentGetPending - parallel pending retrieval

  • CLI Integration Tests (cmd/cli/integration_test.go): 8 new tests

    • TestCLI_Help_ShowsCommands - help output verification
    • TestCLI_InvalidCommand_ShowsHelp - error handling
    • TestCLI_Version_ShowsVersion - version variants
    • TestCLI_Validate_ValidPayloadFile - real file validation
    • TestCLI_Validate_InvalidFile - error handling
    • Guarded with WAFTESTER_INTEGRATION=1 env check

  • Structural Verification Tests (test/structural_test.go): 6 new tests

    • TestAllPackagesHaveTests - 130/131 packages covered (99.2%)
    • TestDispatcherWiringComplete - 9 wiring test functions
    • TestNoTODOsInTests - informational scan
    • TestVersion_Consistent - semver validation
    • TestCmdCliHasDispatcherWiringTests - existence check
    • TestGoModConsistency - module configuration

  • CI Race Detection Workflow (.github/workflows/race-test.yml)

    • Triggers on push to main/develop and PRs
    • Uses ubuntu-latest with gcc for race detector
    • Full race test: go test -race -timeout 10m ./...
    • Focused race tests: go test -race -run ".*Race.*|.*Concurrent.*"
    • Coverage reporting with artifact upload

Changed

  • Upgraded test count from 3,321 to 3,448 (+127 tests, +3.8%)
  • Package test coverage: 184/189 → 188/189 (99.5%)
  • Added race-safe patterns across all new tests using atomic operations

Technical Details

  • All concurrent tests use sync.WaitGroup for goroutine coordination
  • Counter verification uses atomic.Int32 or sync/atomic operations
  • Mock implementations are thread-safe with sync.Mutex protection
  • Tests designed to complete quickly (~50ms average per concurrent test)

[2.5.2] - 2026-02-03

Added

  • Connection Drop Detection (pkg/detection): Comprehensive network-level failure detection

    • TCP Reset (RST) detection - catches forced connection terminations
    • TLS Handshake Abort detection - identifies SSL/TLS negotiation failures
    • Connection Timeout detection - detects unresponsive targets
    • Unexpected EOF detection - catches mid-stream connection closures
    • Tarpit detection - identifies intentional slow-response blocking (3x baseline threshold)
    • Connection Refused detection - catches active port rejection
    • DNS Resolution Failure detection - identifies hostname lookup issues
    • Per-host tracking with thread-safe atomic counters
    • Automatic recovery detection after consecutive successful probes

  • Silent Ban Detection (pkg/detection): Behavioral analysis for subtle blocking patterns

    • Latency drift detection - flags 200%+ response time increases vs baseline
    • Body size drift detection - catches 50%+ content size changes
    • Header change monitoring - detects WAF header injection (Server, X-Cache, CF-Ray, etc.)
    • Consecutive error tracking - identifies systematic failures
    • Honeypot detection - catches 90%+ body size changes indicating redirect
    • Confidence scoring system (0.0-1.0) with multi-factor analysis
    • Ban type classification: RateLimit, IPBlock, Behavioral, Honeypot, GeoBlock, SessionPoison

  • Unified Detection Interface: Combined monitoring with skip recommendations

    • detection.Default() singleton for global access
    • ShouldSkipHost() - returns skip recommendation with reason
    • RecordError()/RecordResponse() - unified tracking API
    • CaptureBaseline() - establishes normal behavior metrics
    • Thread-safe design with sync.RWMutex protection

  • Unified Detection Stats Output (pkg/output/detection): Centralized stats display

    • Multi-format output: Console, JSON, Markdown, SARIF
    • Stats struct with DropsDetected, BansDetected, HostsSkipped, Details
    • FromDetector() - extracts stats from global detector singleton
    • FromProvider() - extracts from any StatsProvider interface implementation
    • FromMap() - constructs from map[string]int for flexible integration
    • HasData(), Severity(), ExitCodeContribution() - analysis methods
    • ToJSON() - structured JSON output for summary files
    • WriteTo(io.Writer, Format) - format-agnostic output
    • PrintConsole() - colorized console output with severity indicators
    • Recommendations() - actionable advice based on detection stats
    • Contract tests ensure all formats include required fields
    • Used by: cmd/cli/assess.go, pkg/output/writer.go, cmd/cli/main.go

  • New Configuration Constants (pkg/defaults, Section 2.5.2):

    • DropDetectConsecutiveThreshold (3) - failures before flagging
    • DropDetectTimeoutMultiplier (3.0) - tarpit detection threshold
    • DropDetectRecoveryProbes (2) - successes needed for recovery
    • DropDetectRecoveryWindow (30s) - max backoff wait time
    • SilentBanLatencyDriftThreshold (2.0) - 200% latency increase
    • SilentBanBodySizeDriftThreshold (0.5) - 50% size change
    • SilentBanConsecutiveErrors (5) - error count threshold
    • SilentBanMinSamples (10) - minimum baseline samples
    • SilentBanHeaderChangeThreshold (3) - header change count
    • SilentBanCooldownPeriod (60s) - wait time after detection

Technical Details

  • New package: pkg/detection/ with 5 files (types.go, connmon.go, silentban.go, detector.go, detector_test.go)
  • 44 unit tests covering all detection scenarios
  • Exponential backoff for recovery: 5s base, doubling up to 30s max
  • EMA (α=0.3) for baseline latency/body size smoothing
  • Key header monitoring: Server, X-Cache, X-CDN, CF-Ray, X-Request-ID, Set-Cookie, Content-Type, X-Frame-Options

Integration

  • Executor Integration (pkg/core/executor.go): Detection wired into test execution

    • Automatic baseline capture on successful responses
    • Drop detection on network errors with enhanced error categorization
    • Silent ban detection on response analysis
    • Skip recommendation before each request
    • Tarpit detection on slow responses

  • TestResult Fields (pkg/output/types.go): New fields for detection data

    • DropDetected, DropType - connection drop information
    • BanDetected, BanType, BanConfidence - silent ban details
    • LatencyDrift - latency change ratio vs baseline

  • Event Types (pkg/output/events/detection.go): Streaming events

    • EventTypeDropDetected - for connection drop events
    • EventTypeBanDetected - for silent ban events
    • DropDetectedEvent, BanDetectedEvent - structured event types

  • Hosterrors Bridge (pkg/detection/detector.go): Synergy with existing cache

    • SyncWithHostErrors() - bridges detection with hosterrors cache
    • ClearHostErrors() - clears both systems
    • ClearAll() - resets all detection state for new scans
    • Automatic sync on 3+ consecutive drops
    • Permanent marking on high-confidence (≥80%) bans

  • CLI Hook Emitters (cmd/cli/output.go): Real-time alerts for detection events

    • EmitDropDetected() - sends drop events to Slack, Teams, PagerDuty, OTEL
    • EmitBanDetected() - sends ban events to all configured hooks

  • Runner Integration (pkg/runner/runner.go): Multi-target detection support

    • EnableDetection() - opt-in detection for runner tasks
    • Skip recommendation before each target
    • Error recording for failed tasks

  • Realistic Package Bridge (pkg/realistic/executor_integration.go): Unified detection

    • UseUnifiedDetection() - enables unified detector alongside block detection
    • ShouldSkipHost() - check skip recommendation from unified detector

  • Execution Statistics (pkg/output/types.go, pkg/core/executor.go):

    • DropsDetected, BansDetected, HostsSkipped in ExecutionResults
    • DetectionStats map with detailed detector metrics

  • CLI Detection Flag (pkg/config/config.go): User control over detection

    • --detect / --detection flag (default: true)
    • Allows disabling detection when not needed

  • Assessment Integration (pkg/assessment/assessment.go): Enterprise assessment detection

    • Detection system integrated into assessment workflow
    • Host skip checks before each payload test
    • Error/response recording for accurate metrics

  • Mutation Executor Integration (pkg/mutation/executor.go): Bypass testing detection

    • Detection system integrated into mutation-based testing
    • Host skip checks prevent wasted requests on blocked hosts
    • Error/response recording for all mutation tests

  • Report Statistics (pkg/report/report.go): Enterprise reports include detection

    • DropsDetected, BansDetected, HostsSkipped fields in Statistics
    • DetectionStats map for detailed breakdown

  • Fuzzer Integration (pkg/fuzz/fuzzer.go): Directory fuzzing detection

    • Detection system integrated into content/directory fuzzing
    • Host skip checks prevent wasted requests on banned hosts
    • Error/response recording for all fuzz requests

  • API Fuzzer Integration (pkg/apifuzz/apifuzz.go): API fuzzing detection

    • Detection system integrated into API endpoint fuzzing
    • Host skip checks in sendFuzzRequest and sendBodyFuzzRequest
    • Error/response recording for all API fuzz operations

  • Recursive Fuzzer Integration (pkg/recursive/recursive.go): Recursive scanning detection

    • Detection system integrated into recursive directory scanning
    • Host skip checks before each directory request
    • Error/response recording with latency tracking

  • Detection Transport Wrapper (pkg/detection/transport.go): Universal HTTP client wrapper

    • WrapTransport() - wraps any http.RoundTripper with detection
    • WrapClient() - convenience function to wrap existing *http.Client
    • SkipHostError - returned when host should be skipped
    • Automatic error/response recording for all requests
    • Pre-request skip checks prevent wasted requests
    • Zero-config integration with existing HTTP code

  • CLI Assess Command Integration (cmd/cli/main.go): Deep scan detection

    • HTTP client wrapped with detection transport
    • Per-scanner skip checks in runScanner() helper
    • Emits scanner_skipped event when host is blocked
    • Prevents wasted time on banned hosts during vulnerability scans

  • HTTP Probe Detection (cmd/cli/main.go): Probe request detection

    • makeProbeHTTPRequestWithOptions() wrapped with detection
    • All HTTP probing benefits from automatic detection

[2.5.1] - 2026-02-03

Fixed

  • Version Consistency: Update defaults.Version to match release tag
  • GoReleaser Deprecations: Fix deprecated config options
    • snapshot.name_template → snapshot.version_template
    • archives.format → archives.formats array
    • archives.format_overrides.format → archives.overrides.formats

[2.5.0] - 2026-02-03

Added

  • Complete Streaming/Hook Integration: All 22 CLI commands now emit to enterprise hooks

    • Every command emits EmitStart for scan lifecycle tracking
    • Every command emits EmitSummary for completion metrics
    • Test-based commands (auto, run, mutate, bypass) emit EmitResult for individual test telemetry
    • Error paths emit EmitError for alerting on failures
    • Discovery commands emit EmitBypass for vulnerability/finding events
    • 179 total emission points across the CLI

  • Architecture Enforcement Tests: Prevent regression of hook wiring

    • TestDispatcherWiringMinimumEmissions: Minimum counts per emission method
    • TestAllDispatcherContextsHaveEmitStart: All 22 dispatchers emit start
    • TestAllDispatcherContextsHaveEmitSummary: All 15 summary-worthy dispatchers emit
    • TestTestBasedCommandsHaveEmitResult: 4 test commands emit per-result telemetry
    • TestOnResultCallbacksHaveEmitResult: OnResult callbacks wired to hooks
    • TestMutationCallbacksHaveEmitResult: Mutation callbacks wired to hooks
    • TestErrorPathsHaveEmitError: 11 error-prone commands emit errors
    • TestDispatcherContextsHaveDeferClose: All dispatchers properly closed
    • TestNoOrphanedDispatcherContexts: No init without EmitStart+Close

  • Streaming Event Architecture: Real-time CI/CD-friendly output

    • New pkg/output/events package with typed events (Start, Progress, Result, Bypass, Summary, Complete, Error)
    • NDJSON streaming mode for pipeline integration (-stream -json)
    • Events emit to stdout while progress goes to stderr for proper pipe handling

  • Unified Output Builder: Factory pattern for all output writers

    • New pkg/output/builder.go with fluent API for constructing output pipelines
    • Single entrypoint for all 15 writers with consistent configuration
    • Thread-safe dispatcher for concurrent multi-format output

  • 15 Output Writers (6 new in v2.5.0):

    • JUnit XML (-format junit): CI/CD test framework integration for Jenkins, GitLab CI, Azure DevOps
    • CycloneDX VEX (-format cyclonedx): SBOM vulnerability exchange format v1.5
    • GitLab SAST (-format gitlab-sast): Native gl-sast-report.json for GitLab Security Dashboard
    • SonarQube (-format sonarqube): Generic Issue Import format
    • DefectDojo (-format defectdojo): Vulnerability management platform import
    • HAR (-format har): HTTP Archive format for request/response analysis
    • Enhanced existing writers: HTML (themes), Markdown (TOC, OWASP sections), PDF (branding), CSV (OWASP columns)

  • 8 Real-time Alerting Hooks:

    • Slack (--slack-webhook): Rich message formatting with severity colors, field blocks
    • Microsoft Teams (--teams-webhook): Adaptive Cards with action buttons
    • PagerDuty (--pagerduty-key): Incident creation with severity routing
    • Jira (--jira-url, --jira-project): Automatic issue creation with configurable project/type
    • GitHub Issues (--github-issues-token, --github-issues-owner, --github-issues-repo): Auto-create issues for bypasses
    • Azure DevOps (--ado-org, --ado-project, --ado-pat): Work item creation with severity mapping
    • OpenTelemetry (--otel-endpoint): Distributed tracing with scan spans and finding events
    • Prometheus (--metrics-port): Metrics exposition endpoint for monitoring
    • Generic Webhook (--webhook): Custom HTTP POST for any integration

  • Exit Code Policy Engine: Configurable pipeline failure conditions

    • New pkg/output/policy package for declarative exit code rules
    • Threshold-based (count, severity) and condition-based (bypass found) policies
    • CI/CD-friendly exit codes: 0=clean, 1=findings, 2=critical, 3=bypass

  • Baseline Comparison: Track security posture over time

    • New pkg/output/baseline package for finding comparison
    • Detects new, fixed, and unchanged vulnerabilities between scans
    • JSON baseline files for CI/CD regression detection

  • Centralized OWASP Data: Single source of truth for compliance mapping

    • New pkg/defaults/owasp.go with OWASPTop10 map and utilities
    • GetOWASPInfo(code), GetAllOWASPCodes(), FormatOWASPReference() helpers
    • AST-based guard test prevents OWASP duplication across codebase

  • Smart Mode Hook Integration: WAF detection and bypass hints emit to CI/CD

    • Detected WAF vendor/confidence emits to all configured hooks
    • Recommended tampers for detected WAF sent to alerting channels
    • Bypass discovery hints streamed in real-time

  • Comprehensive Finding Emissions: All security discoveries emit to hooks

    • Cloud assets: S3 buckets, subdomains, cloud URLs, attack surface
    • Browser risks, TLS issues, certificate problems
    • OAuth/SAML endpoints, authentication attack surface
    • Template validation errors, workflow step completions
    • Crawled scripts, headless page discoveries, probe technology detection
    • Policy violations from security misconfigurations

  • Centralized Timeout Configuration: All durations in pkg/duration

    • Migrated hardcoded timeouts across 40+ files
    • duration.Timeout* and duration.Interval* constants
    • Prometheus hook uses centralized timeout values

Changed

  • CLI Output Integration: All scan commands now use unified output architecture

    • cmd/cli/output.go bridges CLI flags to output builder
    • Consistent flag handling for format, hooks, streaming, templates
    • Automatic format detection from file extension

  • HTML Reports: Nuclei-level quality with interactive features

    • 4 themes: light, dark, corporate, security
    • Interactive severity charts with Chart.js
    • Collapsible finding details, syntax-highlighted code blocks
    • Executive summary with key metrics

  • PDF Reports: Professional executive quality

    • Custom branding, signatures, watermarks
    • OWASP Top 10 compliance matrix
    • Severity distribution pie charts
    • Page headers/footers with metadata

  • Markdown Reports: Wiki-ready documentation

    • Auto-generated table of contents (--md-toc)
    • OWASP category grouping (--md-owasp)
    • Collapsible sections with evidence

Fixed

  • OpenTelemetry Hook: Uses defaults.Version for service version
  • OpenTelemetry Tests: Skip gracefully when collector unavailable
  • Webhook Hook: Uses defaults.RetryMedium instead of hardcoded retry count
  • GitLab SAST Version: Spec version (15.0.0) excluded from version consistency test
  • Prometheus Timeout: Uses duration.TimeoutHTTP instead of hardcoded value
  • Tool Names: Centralized hardcoded tool name strings

Tests

  • 29,000+ lines of comprehensive test coverage:
    • pkg/output/writers/writers_test.go: All 15 writers
    • pkg/output/hooks/hooks_test.go: All 8 hooks
    • pkg/output/events/events_test.go: Event serialization/deserialization
    • pkg/output/policy/policy_test.go: Exit code policy evaluation
    • pkg/output/baseline/baseline_test.go: Baseline comparison logic
    • pkg/output/integration_test.go: End-to-end output pipeline
    • pkg/defaults/defaults_test.go: OWASP duplication guard
    • cmd/cli/dispatcher_wiring_test.go: 9 architecture enforcement tests (350 lines)

Documentation

  • README.md: Updated output formats table, enterprise integrations, alerting hooks
  • EXAMPLES.md: Added JUnit, CycloneDX, GitHub Actions, OpenTelemetry sections
  • Integration Guide: Comprehensive guide for CI/CD pipeline integration
  • Sample Outputs: Complete sample output files for all 15 formats
  • SECURITY.md: Updated supported versions for v2.5.x
  • CONTRIBUTING.md: Added dispatcher wiring enforcement tests

[2.4.3] - 2026-02-02

Added

  • HTTP Client Pooling: Industry-aligned connection pooling with semantic presets

    • New pkg/httpclient package with NewScanner(), NewProbing(), NewAggressive() presets
    • Aligned with fasthttp, Caddy, Traefik, Nuclei, HTTPx best practices

  • Centralized Configuration: Single source of truth for all runtime defaults

    • New pkg/defaults package: Concurrency, Retry, Buffer, Channel, ContentType, UserAgent, Depth, MaxRedirects
    • New pkg/duration package: All timeout and interval constants

  • 10 AST-Based Enforcement Tests: Prevent configuration drift at compile time

    • TestVersionConsistency: Ensures ui.Version == defaults.Version, checks SECURITY.md
    • TestNoHardcodedConcurrency: All concurrency values use defaults.Concurrency*
    • TestNoHardcodedRetries: All retry counts use defaults.Retry*
    • TestNoHardcodedMaxDepth: All depth limits use defaults.Depth*
    • TestNoHardcodedMaxRedirects: All redirect limits use defaults.MaxRedirects
    • TestNoHardcodedContentType: All content types use defaults.ContentType*
    • TestNoHardcodedUserAgent: All UAs use defaults.UA* or ui.UserAgentWithContext()
    • TestNoHardcodedTimeouts: All timeouts use duration.Timeout*
    • TestNoHardcodedIntervals: All intervals use duration.Interval*
    • TestNoRawHTTPClient: No raw &http.Client{}, must use httpclient.*

Changed

  • User-Agent Unification: All components now use consistent UA format

    • Browser-like UAs use defaults.UAChrome, defaults.UAFirefox, etc.
    • Component-specific UAs use ui.UserAgentWithContext("Component") → waftester/2.4.3 (Component)

  • Version Management: Single source of truth in defaults.Version

    • ui.Version now references defaults.Version
    • SARIF output, enhanced JSON, and all reports use centralized version

Fixed

  • 54+ Files Updated: Migrated hardcoded values to centralized constants
  • Test Expectations: Updated tests to use defaults.* constants instead of magic numbers

[2.4.2] - 2026-02-02

Added

  • Intelligent Tamper Engine: Full integration of 70+ sqlmap-compatible tampers into auto and scan modes

    • New --tamper flag: Specify custom tampers (e.g., --tamper=space2comment,randomcase)
    • New --tamper-auto flag: Automatically select optimal tampers based on detected WAF
    • New --tamper-profile flag: Use predefined profiles (stealth, standard, aggressive, bypass, custom)

  • WAF Intelligence Matrix: Curated tamper recommendations for 16+ WAF vendors

    • Cloudflare, AWS WAF, Akamai, Imperva, Azure WAF, F5 BIG-IP, Fortinet FortiWeb
    • ModSecurity, Barracuda, Sucuri, Radware, Citrix, Palo Alto, Sophos, Wallarm
    • Each vendor mapped to optimal tamper chains with effectiveness scores

  • Tampers Subcommand (waf-tester tampers):

    • --list: List all 70+ available tampers with descriptions
    • --category: Filter by category (encoding, space, sql, mysql, mssql, waf, http, obfuscation)
    • --for-waf=<vendor>: Show recommended tampers for a specific WAF
    • --test "<payload>": Test payload transformation step-by-step
    • --matrix: Display full WAF intelligence matrix
    • --json: Output in JSON format for automation

  • Real-time Metrics Collection: Track tamper effectiveness during scans

    • Success rates, block rates, latency tracking per tamper
    • Top performers analysis for adaptive learning
    • Thread-safe atomic operations for concurrent scanning

  • Adaptive Learning: Engine learns from scan results to optimize future tamper selection

    • RecordSuccess/RecordFailure methods update tamper rankings
    • Priority-based chaining adjusts based on observed effectiveness

Changed

  • Auto Mode Enhancement: Now automatically applies optimal tamper chains when WAF is detected
  • Scan Mode Enhancement: Tamper flags available for manual bypass testing
  • Strategy Integration: WAF strategy now includes tamper recommendations

Documentation

  • README.md Updates:

    • Added tampers command to Commands table
    • Expanded Tamper Scripts section with new flags and examples

  • EXAMPLES.md Updates:

    • Added “With Automatic Tamper Selection” subsection to auto mode
    • Added “With Smart Mode and Tampers” subsection to scan mode
    • Enhanced bypass command with --tamper-auto and --tamper-profile examples
    • Expanded Tamper Scripts section with 5 new subsections:
      • Auto-Select Tampers (v2.4.2+)
      • Tamper Profiles (v2.4.2+)
      • WAF Intelligence Matrix (v2.4.2+)
      • Test Payload Transformation (v2.4.2+)
      • Full vendor list for matrix

[2.4.1] - 2026-02-02

Fixed

  • CI Release Workflow: Release publishing now verifies tags are on the main branch before proceeding
    • Prevents accidental releases from feature/fix branches
    • Clear error message when tag is not on main

Documentation

  • Comprehensive EXAMPLES.md Rewrite: Expanded from 651 to 2,200+ lines

    • Added 100+ probe command options (httpx-compatible)
    • Added fuzz modes: sniper, pitchfork, clusterbomb
    • Added recursive fuzzing and wordlist transformations
    • Added scan severity/category filtering and OAuth testing
    • Added smuggle safe/full modes and race attack types
    • Added headless browser testing options
    • Added workflow orchestration with YAML examples
    • Added crawl content extraction options
    • Added analyze JavaScript analysis options

  • README Updates:

    • Added 8 missing commands to Commands table
    • Added 4 new feature highlights
    • Enhanced command descriptions with compatibility notes

[2.4.0] - 2026-02-02

Fixed

  • Unicode Truncation Bugs: Fixed uint16 truncation for runes > 0xFFFF in hexutil and tampers packages
  • JSUnicodeEncoder Truncation: Fixed encoder casting rune to byte, truncating characters > 255
  • Empty Payload Panic: Fixed payload[:1] panic in protocol.go when payload is empty
  • Nil Dereference from url.Parse: Fixed ignored errors causing nil pointer panics in:
    • pkg/openapi/generator.go
    • pkg/brokenauth/brokenauth.go
    • pkg/apifuzz/apifuzz.go
    • pkg/discovery/sources.go
    • cmd/cli/main.go
  • Nil Dereference from http.NewRequestWithContext: Fixed ignored errors causing nil pointer panics in:
    • pkg/securitymisconfig/securitymisconfig.go
    • pkg/enterprise/protocols.go
    • pkg/businesslogic/businesslogic.go
    • pkg/brokenauth/brokenauth.go
    • pkg/assessment/assessment.go
    • pkg/apiabuse/apiabuse.go
    • pkg/accesscontrol/accesscontrol.go
  • Overlong UTF-8 Encoding: Fixed WriteOverlong2Byte/WriteOverlong3Byte format bugs in hexutil

Added

  • 68 SQLMap-Compatible Tamper Scripts: Complete port of sqlmap’s tamper library for WAF bypass

    • --tamper flag to apply payload transformations
    • Support for tamper chaining: --tamper "space2comment,randomcase,base64encode"
    • Priority-based execution with ChainByPriority()
    • HTTP-level request transformations via TransformRequest()

  • Tamper Categories (8 categories, 68 scripts):

    • encoding (12): base64encode, charencode, htmlencode, overlongutf8, unmagicquotes, etc.
    • space (12): space2comment, space2plus, space2dash, blankspace, varnishbypass, etc.
    • sql (16): apostrophemask, between, equaltolike, randomcase, symboliclogical, etc.
    • mysql (10): modsecurityversioned, versionedkeywords, misunion, multipleurlencode, etc.
    • mssql (6): mssqlblind, chardeclareandexec, topclause, bracketcomment, etc.
    • waf (4): informationschemacomment, luanginxwaf, jsonobfuscate, schemasplit
    • http (3): xforwardedfor, randomuseragent, varnishbypass
    • obfuscation (6): commentrandom, nullbyte, suffix, concat, slashstar, etc.

  • Protocol Testing Documentation: README updated with guidance for:

    • GraphQL endpoint testing (introspection, mutations, batching)
    • gRPC service testing (reflection, protobuf payloads)
    • SOAP/XML testing (XXE, WSDL enumeration)

Technical

  • Thread-safe tamper registry with Get, List, ByCategory, ByTag functions
  • Tamper interface: Transform(payload string) string + TransformRequest(req *http.Request) *http.Request
  • Full test coverage for all 68 tampers (8 test files, 1000+ test cases)
  • New package: pkg/evasion/advanced/tampers/

Performance

  • Hex Lookup Tables: Pre-computed 256-entry tables eliminate fmt.Sprintf overhead
  • Pre-allocated Buffers: strings.Builder.Grow() prevents reallocations during transforms
  • Regex Caching: All patterns use regexcache.MustGet() for 315x faster repeat matches
  • Batch Lookups: GetMultiple() reduces lock contention for tamper chaining
  • Single-Pass Patterns: SQL keyword matching uses alternation instead of per-keyword loops
  • Static Replacers: HTMLEncode replacer created once at package level
  • Main App Encoding Optimization: pkg/waf/evasion.go now uses hexutil lookup tables
  • Encoder Package Optimization: pkg/encoding/encoders.go hot paths optimized
  • Mutation Encoder Optimization: pkg/mutation/encoder hot paths optimized
  • New hexutil Package: internal/hexutil provides shared high-performance encoding utilities

Benchmarks (Intel Ultra 7 265U):

  • HexEscape: 380ns vs 7,435ns fmt.Sprintf (19.6x faster, 98% fewer allocs)
  • URLEncode: 325ns vs 5,831ns fmt.Sprintf (18.0x faster, 98% fewer allocs)
  • BinaryEncode: 361ns vs 5,844ns fmt.Sprintf (16.2x faster, 98% fewer allocs)
  • UnicodeEscape: 743ns vs 7,123ns fmt.Sprintf (9.6x faster, 98% fewer allocs)
  • CharEncode: 352ns/op, 1 alloc
  • Chain(5 tampers): 5.8μs/op
  • Registry Get(): 23ns/op, 0 allocs

[2.3.5] - 2026-02-02

Fixed

  • Clean JSON Output in Auto Mode: All informational output now correctly goes to stderr when -json flag is used
  • Smart Mode Output: PrintSmartModeInfo() now respects silent mode and uses stderr
  • Execution Manifest: Default writer changed from stdout to stderr; respects IsSilent() check
  • Progress Display: All progress bars and stats now properly output to stderr
  • Banner/Config: All UI functions (PrintConfig, PrintConfigLine, PrintBracketedInfo, PrintResult) now use stderr
  • Results Summary: PrintSummary, PrintWAFEffectiveness, PrintLiveResult use stderr and respect silent mode
  • Live Progress: Default writer changed from stdout to stderr

Changed

  • Auto mode (waf-tester auto -json) now outputs only valid JSON to stdout
  • All phase headers, progress indicators, and informational output redirected to stderr
  • Silent mode automatically enabled for JSON/JSONL output formats

[2.3.4] - 2026-02-01

Performance

  • Comprehensive HTTP Keep-Alive Optimization: Migrated 165+ resp.Body.Close() patterns to iohelper.DrainAndClose() for proper connection reuse
  • Safe Body Reading: Migrated 23 io.ReadAll(io.LimitReader()) patterns to iohelper.ReadBody() with size limits (8KB/100KB/1MB)
  • Regex Caching: Migrated hot-path regexp.MustCompile() to regexcache.MustGet() (315x faster on cache hits)
  • Removed Redundant Code: Eliminated duplicate io.Copy(io.Discard) calls after DrainAndClose

Changed

  • All scanner packages now use iohelper for consistent HTTP response handling
  • WAF detection, discovery, and API packages optimized for connection pooling
  • 83 files updated with consistent resource management patterns

Documentation

  • Added --json flag examples to README.md for automation/CI use cases
  • Added --json automation section to docs/EXAMPLES.md
  • Highlighted JSON output flag across all documentation

2.3.3 - 2026-02-01

Added

  • Real-time Streaming JSON Events: New -stream -json mode emits NDJSON events to stdout for CI/CD pipelines
    • Event types: scan_start, vulnerability, scan_complete, scan_end
    • Progress output goes to stderr, JSON events to stdout for clean piping
    • Example: waf-tester scan -u https://target.com -stream -json | jq
  • Guaranteed Event Emission: All 35+ scanners now use defer pattern to emit scan_complete even on errors
  • Banner Suppression: Banner and config output suppressed in -stream -json mode for clean JSON output

Changed

  • Refactored all scanners to use defer pattern for reliable event emission
  • Error handling improved: errors are logged (if verbose) but don’t skip completion events
  • Streaming mode now properly separates progress (stderr) from data (stdout)

Fixed

  • Scanners no longer silently skip scan_complete events on early returns or errors
  • techdetect scanner no longer hangs on slow DiscoverAll() calls
  • Duplicate streamJSON variable declarations removed
  • wafdetect scanner type mismatch with WAFInfo slice fixed

CI/CD Improvements

  • Pipeline tools can now reliably count scanner completions
  • NDJSON output compatible with jq, log aggregators, and monitoring tools
  • Clean stdout output suitable for > results.jsonl redirection

2.3.2 - 2026-02-01

Added

  • CI/CD Pipeline Integration: New --stream flag across 10+ commands for clean pipeline output
  • LiveProgress Component: Unified progress display with Interactive/Streaming/Silent modes (pkg/ui/liveprogress.go)
  • ExecutionManifest Component: Pre-run display showing payload counts, targets, categories (pkg/ui/manifest.go)
  • Commands now show payload count and target summary before execution starts

Changed

  • Refactored assess, bypass, smuggle, headless commands to use LiveProgress
  • Consolidated 400+ lines of duplicated inline progress code into reusable components
  • All animated progress displays now respect --stream flag

Fixed

  • ANSI escape codes no longer pollute CI/CD pipeline logs when using --stream
  • Consistent progress display behavior across all major commands

CI/CD

  • Releases now automatically marked as “Latest” on GitHub
  • Tag overwrites supported for re-releases (preserves changelog history)

2.3.1 - 2026-01-31

Added

  • Authenticated browser scanning with manual login support (MFA, CAPTCHA, SSO)
  • Community payloads now bundled in release archives
  • Clear documentation for browser scanning requirements

Fixed

  • Race conditions in discovery, distributed, and deserialize packages
  • Version embedding via ldflags in release builds
  • Centralized 40+ hardcoded User-Agent strings to use ui.UserAgent()
  • CI/CD template install paths now correctly reference cmd/cli

Changed

  • Updated README with browser scanning documentation
  • All payload files included in release archives

2.3.0 - 2026-01-27

Added

  • Initial public release
  • CLI with 50+ attack types
  • 320+ command-line flags
  • Community payload set (2,800+ payloads)
  • WAF detection with 197 vendor signatures
  • Smart mode with WAF-aware testing
  • Multiple output formats (JSON, SARIF, Markdown, HTML)
  • Enterprise assessment mode with quantitative metrics

Security

  • BSL 1.1 license for core engine
  • MIT license for community payloads