From 090f0c22aa106d4de4436531282737dded723d02 Mon Sep 17 00:00:00 2001 From: Mzack9999 Date: Sat, 21 Mar 2026 18:47:59 +0100 Subject: [PATCH 01/32] parser for fqdn --- common/httpx/domains.go | 442 +++++++- common/httpx/domains_test.go | 1081 ++++++++++++++++++++ common/httpx/test-data/sample_with_js.html | 52 + go.mod | 2 + go.sum | 4 + 5 files changed, 1561 insertions(+), 20 deletions(-) create mode 100644 common/httpx/test-data/sample_with_js.html diff --git a/common/httpx/domains.go b/common/httpx/domains.go index 3a410e56e..d705fb008 100644 --- a/common/httpx/domains.go +++ b/common/httpx/domains.go @@ -1,25 +1,32 @@ package httpx import ( + "bytes" + "net/url" "regexp" "strings" "unicode" + "github.com/PuerkitoBio/goquery" + "github.com/dop251/goja/ast" + "github.com/dop251/goja/parser" mapsutil "github.com/projectdiscovery/utils/maps" stringsutil "github.com/projectdiscovery/utils/strings" "github.com/weppos/publicsuffix-go/publicsuffix" ) const ( - // group 1 is actual domain regex while group 0 and group 2 are used to filter out invalid matches (by skipping irrelevant contexts) potentialDomainRegex = `(?:^|['"/@])` + `([a-z0-9]+[a-z0-9.-]*\.[a-z]{2,})` + `(?:['"/@]|$)` ) var ( - // potentialDomainsCompiled is a compiled regex for potential domains (aka domain names) potentialDomainsCompiled = regexp.MustCompile(potentialDomainRegex) defaultDenylist = []string{".3g2", ".3gp", ".7z", ".apk", ".arj", ".avi", ".axd", ".bmp", ".csv", ".deb", ".dll", ".doc", ".drv", ".eot", ".exe", ".flv", ".gif", ".gifv", ".gz", ".h264", ".ico", ".iso", ".jar", ".jpeg", ".jpg", ".lock", ".m4a", ".m4v", ".map", ".mkv", ".mov", ".mp3", ".mp4", ".mpeg", ".mpg", ".msi", ".ogg", ".ogm", ".ogv", ".otf", ".pdf", ".pkg", ".png", ".ppt", ".psd", ".rar", ".rm", ".rpm", ".svg", ".swf", ".sys", ".tar.gz", ".tar", ".tif", ".tiff", ".ttf", ".txt", ".vob", ".wav", ".webm", ".webp", ".wmv", ".woff", ".woff2", ".xcf", ".xls", ".xlsx", ".zip", ".css", ".js", ".map", ".php", ".sheet", ".ms", ".wp", ".html", ".htm", ".md"} suffixBlacklist = map[string]struct{}{} + + urlAttrs = []string{"href", "src", "action", "formaction", "poster", "cite", "data-url", "data-href"} + + maxInlineScriptSize = 512 * 1024 // skip JS AST parsing for scripts larger than 512KB ) type BodyDomain struct { @@ -31,34 +38,429 @@ func (h *HTTPX) BodyDomainGrab(r *Response) *BodyDomain { domains := make(map[string]struct{}) fqdns := make(map[string]struct{}) - for _, tmp := range potentialDomainsCompiled.FindAllStringSubmatch(r.Raw, -1) { - // only interested in 1st group + // Only run HTML/JS parsers if the body looks like HTML + if len(r.Data) > 0 && looksLikeHTML(r.Data) { + inlineScripts := extractDomainsFromHTML(r.Data, domains, fqdns, r.Input) + + for _, script := range inlineScripts { + if len(script) <= maxInlineScriptSize { + extractDomainsFromJS(script, domains, fqdns, r.Input) + } + } + } + + // Regex fallback on the raw response (catches anything the parsers miss) + extractDomainsFromRegex(r.Raw, domains, fqdns, r.Input) + + return &BodyDomain{Domains: mapsutil.GetKeys(domains), Fqdns: mapsutil.GetKeys(fqdns)} +} + +func looksLikeHTML(data []byte) bool { + prefix := data + if len(prefix) > 1024 { + prefix = prefix[:1024] + } + trimmed := bytes.TrimSpace(prefix) + return len(trimmed) > 0 && trimmed[0] == '<' +} + +// extractDomainsFromHTML parses HTML and extracts hostnames from URL-bearing +// attributes (href, src, action, etc.), meta tags, and srcset values. +// It returns the text content of inline ` + response := &Response{ + Raw: html, + Data: []byte(html), + } + bd := ht.BodyDomainGrab(response) + require.NotNil(t, bd) +} + +func TestExtractDomainsFromJS(t *testing.T) { + domains := make(map[string]struct{}) + fqdns := make(map[string]struct{}) + + script := ` + var url = "https://api.test.example.com/v1/users"; + var cdn = "https://cdn.test.example.net/assets/main.js"; + var num = 42; + var noDomain = "just a plain string"; + ` + extractDomainsFromJS(script, domains, fqdns, "") + + require.Contains(t, fqdns, "api.test.example.com") + require.Contains(t, fqdns, "cdn.test.example.net") + require.Equal(t, 2, len(fqdns)) +} + +func TestExtractDomainsFromHTML(t *testing.T) { + domains := make(map[string]struct{}) + fqdns := make(map[string]struct{}) + + html := []byte(` + + link + + + + `) + + inlineScripts := extractDomainsFromHTML(html, domains, fqdns, "") + + require.Contains(t, fqdns, "link.test.example.com") + require.Contains(t, fqdns, "img.test.example.org") + require.Len(t, inlineScripts, 1) + require.Contains(t, inlineScripts[0], "inline.test.example.net") +} + +// --- False positive rejection tests --- + +func TestFalsePositive_IPAddresses(t *testing.T) { + ht, err := New(&DefaultOptions) + require.Nil(t, err) + + html := ` + router + internal + + ` + response := &Response{Raw: html, Data: []byte(html)} + bd := ht.BodyDomainGrab(response) + + for _, d := range bd.Domains { + require.False(t, isAllNumericParts(d), "IP address should not appear in domains: %s", d) + } + for _, f := range bd.Fqdns { + require.False(t, isAllNumericParts(f), "IP address should not appear in fqdns: %s", f) + } +} + +func TestFalsePositive_PackageNames(t *testing.T) { + ht, err := New(&DefaultOptions) + require.Nil(t, err) + + html := ` + + ` + response := &Response{Raw: html, Data: []byte(html)} + bd := ht.BodyDomainGrab(response) + + for _, f := range bd.Fqdns { + require.NotContains(t, f, "com.google.android", "Java/Android package name should be rejected: %s", f) + require.NotContains(t, f, "org.apache.commons", "Java package name should be rejected: %s", f) + require.NotContains(t, f, "io.netty.handler", "Java package name should be rejected: %s", f) + } +} + +func TestFalsePositive_FileExtensions(t *testing.T) { + ht, err := New(&DefaultOptions) + require.Nil(t, err) + + html := ` + report + css + js + + + ` + response := &Response{Raw: html, Data: []byte(html)} + bd := ht.BodyDomainGrab(response) + + for _, f := range bd.Fqdns { + require.NotEqual(t, "report.pdf", f) + require.NotEqual(t, "style.css", f) + require.NotEqual(t, "app.js", f) + require.NotEqual(t, "logo.png", f) + } +} + +func TestFalsePositive_VersionStrings(t *testing.T) { + ht, err := New(&DefaultOptions) + require.Nil(t, err) + + html := ` + +

Running version 2.4.1 of the software

+ ` + response := &Response{Raw: html, Data: []byte(html)} + bd := ht.BodyDomainGrab(response) + + require.Empty(t, bd.Fqdns, "version strings should not produce fqdns") + require.Empty(t, bd.Domains, "version strings should not produce domains") +} + +func TestFalsePositive_CSSClassNames(t *testing.T) { + ht, err := New(&DefaultOptions) + require.Nil(t, err) + + html := ` +
test
+ + ` + response := &Response{Raw: html, Data: []byte(html)} + bd := ht.BodyDomainGrab(response) + + for _, f := range bd.Fqdns { + require.NotContains(t, f, "header.main") + require.NotContains(t, f, "container.fluid") + require.NotContains(t, f, "nav.active") + } +} + +func TestFalsePositive_MinifiedJSVars(t *testing.T) { + ht, err := New(&DefaultOptions) + require.Nil(t, err) + + // minified JS often has expressions like e.target, n.value, t.id + html := `` + response := &Response{Raw: html, Data: []byte(html)} + bd := ht.BodyDomainGrab(response) + + require.Empty(t, bd.Fqdns, "minified JS property accesses should not produce fqdns") + require.Empty(t, bd.Domains, "minified JS property accesses should not produce domains") +} + +func TestFalsePositive_MailtoAndTelLinks(t *testing.T) { + ht, err := New(&DefaultOptions) + require.Nil(t, err) + + html := ` + email + call + ` + response := &Response{Raw: html, Data: []byte(html)} + bd := ht.BodyDomainGrab(response) + + // mailto and tel links should not be parsed by the HTML extractor + // but the regex fallback may still catch domains from the raw text + require.NotNil(t, bd) +} + +func TestFalsePositive_DataURIs(t *testing.T) { + ht, err := New(&DefaultOptions) + require.Nil(t, err) + + html := ` + + data link + ` + response := &Response{Raw: html, Data: []byte(html)} + bd := ht.BodyDomainGrab(response) + + require.Empty(t, bd.Fqdns, "data URIs should not produce fqdns") + require.Empty(t, bd.Domains, "data URIs should not produce domains") +} + +func TestFalsePositive_WebpackChunks(t *testing.T) { + ht, err := New(&DefaultOptions) + require.Nil(t, err) + + html := ` + + + ` + response := &Response{Raw: html, Data: []byte(html)} + bd := ht.BodyDomainGrab(response) + + for _, f := range bd.Fqdns { + require.NotContains(t, f, "chunk") + require.NotContains(t, f, "runtime") + } +} + +// --- Edge case tests --- + +func TestEdgeCase_ProtocolRelativeURLs(t *testing.T) { + ht, err := New(&DefaultOptions) + require.Nil(t, err) + + html := ` + + + + ` + response := &Response{Raw: html, Data: []byte(html)} + bd := ht.BodyDomainGrab(response) + + require.Contains(t, bd.Fqdns, "cdn.proto-relative.example.com") + require.Contains(t, bd.Fqdns, "images.proto-relative.example.net") + require.Contains(t, bd.Fqdns, "fonts.proto-relative.example.org") +} + +func TestEdgeCase_MetaRefreshRedirect(t *testing.T) { + ht, err := New(&DefaultOptions) + require.Nil(t, err) + + html := ` + + ` + response := &Response{Raw: html, Data: []byte(html)} + bd := ht.BodyDomainGrab(response) + + require.Contains(t, bd.Fqdns, "redirect.meta-refresh.example.com") +} + +func TestEdgeCase_JSONLDScripts(t *testing.T) { + ht, err := New(&DefaultOptions) + require.Nil(t, err) + + html := ` + + ` + response := &Response{Raw: html, Data: []byte(html)} + bd := ht.BodyDomainGrab(response) + + require.Contains(t, bd.Fqdns, "www.jsonld-org.example.com") + require.Contains(t, bd.Fqdns, "cdn.jsonld-org.example.com") +} + +func TestEdgeCase_TrailingDots(t *testing.T) { + ht, err := New(&DefaultOptions) + require.Nil(t, err) + + html := ` + link + ` + response := &Response{Raw: html, Data: []byte(html)} + bd := ht.BodyDomainGrab(response) + + require.Contains(t, bd.Fqdns, "trailing-dot.example.com") + for _, f := range bd.Fqdns { + require.False(t, strings.HasSuffix(f, "."), "domain should not have trailing dot: %s", f) + } +} + +func TestEdgeCase_Deduplication(t *testing.T) { + ht, err := New(&DefaultOptions) + require.Nil(t, err) + + html := ` + link1 + link2 + link3 + + ` + response := &Response{Raw: html, Data: []byte(html)} + bd := ht.BodyDomainGrab(response) + + count := 0 + for _, f := range bd.Fqdns { + if f == "dedup.example.com" { + count++ + } + } + require.Equal(t, 1, count, "duplicate fqdns should be deduplicated") +} + +func TestEdgeCase_InputDomainExclusion(t *testing.T) { + ht, err := New(&DefaultOptions) + require.Nil(t, err) + + html := ` + self + other + ` + response := &Response{ + Raw: html, + Data: []byte(html), + Input: "example.com", + } + bd := ht.BodyDomainGrab(response) + + // example.com is the input domain, should be excluded from domains list + for _, d := range bd.Domains { + require.NotEqual(t, "example.com", d, "input domain should be excluded from domains") + } + // self.example.com equals the input, should be excluded from fqdns + for _, f := range bd.Fqdns { + require.NotEqual(t, "example.com", f, "input should be excluded from fqdns") + } + require.Contains(t, bd.Domains, "different.net") + require.Contains(t, bd.Fqdns, "other.different.net") +} + +func TestEdgeCase_EmptyAndWhitespaceScripts(t *testing.T) { + ht, err := New(&DefaultOptions) + require.Nil(t, err) + + html := ` + + + + ` + response := &Response{Raw: html, Data: []byte(html)} + bd := ht.BodyDomainGrab(response) + + require.NotNil(t, bd) + require.Empty(t, bd.Fqdns) +} + +func TestEdgeCase_MultipleScriptsSomeBroken(t *testing.T) { + ht, err := New(&DefaultOptions) + require.Nil(t, err) + + html := ` + + + + + ` + response := &Response{Raw: html, Data: []byte(html)} + bd := ht.BodyDomainGrab(response) + + require.Contains(t, bd.Fqdns, "valid.multi-script.example.com") + require.Contains(t, bd.Fqdns, "also-valid.multi-script.example.net") +} + +func TestEdgeCase_URLsWithQueryAndFragment(t *testing.T) { + ht, err := New(&DefaultOptions) + require.Nil(t, err) + + html := ` + query + fragment + both + ` + response := &Response{Raw: html, Data: []byte(html)} + bd := ht.BodyDomainGrab(response) + + require.Contains(t, bd.Fqdns, "query.example.com") + require.Contains(t, bd.Fqdns, "fragment.example.com") + require.Contains(t, bd.Fqdns, "both.example.com") +} + +func TestEdgeCase_MixedCaseURLs(t *testing.T) { + ht, err := New(&DefaultOptions) + require.Nil(t, err) + + html := ` + upper + mixed + ` + response := &Response{Raw: html, Data: []byte(html)} + bd := ht.BodyDomainGrab(response) + + require.Contains(t, bd.Fqdns, "upper.case.example.com") + require.Contains(t, bd.Fqdns, "mixed.case.example.net") +} + +func TestEdgeCase_URLsWithPorts(t *testing.T) { + ht, err := New(&DefaultOptions) + require.Nil(t, err) + + html := ` + port + + ` + response := &Response{Raw: html, Data: []byte(html)} + bd := ht.BodyDomainGrab(response) + + require.Contains(t, bd.Fqdns, "ported.example.com") + require.Contains(t, bd.Fqdns, "ported-js.example.net") + for _, f := range bd.Fqdns { + require.NotContains(t, f, ":", "port numbers should not appear in extracted domains") + } +} + +func TestEdgeCase_URLsWithAuth(t *testing.T) { + ht, err := New(&DefaultOptions) + require.Nil(t, err) + + html := ` + authed + ` + response := &Response{Raw: html, Data: []byte(html)} + bd := ht.BodyDomainGrab(response) + + require.Contains(t, bd.Fqdns, "authed.example.com") +} + +func TestEdgeCase_JSArrowFunctions(t *testing.T) { + domains := make(map[string]struct{}) + fqdns := make(map[string]struct{}) + + script := ` + const fetchData = () => fetch("https://api.arrow.example.com/data"); + const urls = ["a", "b"].map(x => "https://map." + x + ".example.net"); + const handler = async () => { + const res = await fetch("https://async-arrow.example.org/endpoint"); + return res; + }; + ` + extractDomainsFromJS(script, domains, fqdns, "") + + require.Contains(t, fqdns, "api.arrow.example.com") + require.Contains(t, fqdns, "async-arrow.example.org") +} + +func TestEdgeCase_JSObjectNesting(t *testing.T) { + domains := make(map[string]struct{}) + fqdns := make(map[string]struct{}) + + script := ` + var config = { + api: { + base: "https://nested-api.example.com/v1", + endpoints: { + users: "https://nested-users.example.com/users", + deep: { + level: "https://nested-deep.example.net/deep" + } + } + } + }; + ` + extractDomainsFromJS(script, domains, fqdns, "") + + require.Contains(t, fqdns, "nested-api.example.com") + require.Contains(t, fqdns, "nested-users.example.com") + require.Contains(t, fqdns, "nested-deep.example.net") +} + +func TestEdgeCase_JSTryCatchFinally(t *testing.T) { + domains := make(map[string]struct{}) + fqdns := make(map[string]struct{}) + + script := ` + try { + fetch("https://try-block.example.com/api"); + } catch(e) { + fetch("https://catch-block.example.net/error"); + } finally { + fetch("https://finally-block.example.org/cleanup"); + } + ` + extractDomainsFromJS(script, domains, fqdns, "") + + require.Contains(t, fqdns, "try-block.example.com") + require.Contains(t, fqdns, "catch-block.example.net") + require.Contains(t, fqdns, "finally-block.example.org") +} + +func TestEdgeCase_JSConditionalTernary(t *testing.T) { + domains := make(map[string]struct{}) + fqdns := make(map[string]struct{}) + + script := ` + var url = isProd + ? "https://prod.ternary.example.com/api" + : "https://dev.ternary.example.net/api"; + ` + extractDomainsFromJS(script, domains, fqdns, "") + + require.Contains(t, fqdns, "prod.ternary.example.com") + require.Contains(t, fqdns, "dev.ternary.example.net") +} + +func TestEdgeCase_JSSwitchCase(t *testing.T) { + domains := make(map[string]struct{}) + fqdns := make(map[string]struct{}) + + script := ` + switch(env) { + case "prod": + url = "https://prod.switch.example.com/api"; + break; + case "staging": + url = "https://staging.switch.example.net/api"; + break; + default: + url = "https://default.switch.example.org/api"; + } + ` + extractDomainsFromJS(script, domains, fqdns, "") + + require.Contains(t, fqdns, "prod.switch.example.com") + require.Contains(t, fqdns, "staging.switch.example.net") + require.Contains(t, fqdns, "default.switch.example.org") +} + +func TestEdgeCase_JSLoops(t *testing.T) { + domains := make(map[string]struct{}) + fqdns := make(map[string]struct{}) + + script := ` + for (var i = 0; i < 10; i++) { + fetch("https://for-loop.example.com/item"); + } + while (true) { + fetch("https://while-loop.example.net/poll"); + break; + } + do { + fetch("https://do-while.example.org/retry"); + } while (false); + ` + extractDomainsFromJS(script, domains, fqdns, "") + + require.Contains(t, fqdns, "for-loop.example.com") + require.Contains(t, fqdns, "while-loop.example.net") + require.Contains(t, fqdns, "do-while.example.org") +} + +func TestEdgeCase_JSIfElse(t *testing.T) { + domains := make(map[string]struct{}) + fqdns := make(map[string]struct{}) + + script := ` + if (condition) { + url = "https://if-branch.example.com/a"; + } else if (other) { + url = "https://elseif-branch.example.net/b"; + } else { + url = "https://else-branch.example.org/c"; + } + ` + extractDomainsFromJS(script, domains, fqdns, "") + + require.Contains(t, fqdns, "if-branch.example.com") + require.Contains(t, fqdns, "elseif-branch.example.net") + require.Contains(t, fqdns, "else-branch.example.org") +} + +func TestEdgeCase_HTMLEntitiesInURLs(t *testing.T) { + ht, err := New(&DefaultOptions) + require.Nil(t, err) + + // goquery auto-decodes & to & + html := ` + entity + ` + response := &Response{Raw: html, Data: []byte(html)} + bd := ht.BodyDomainGrab(response) + + require.Contains(t, bd.Fqdns, "entity.example.com") +} + +func TestEdgeCase_FormactionAttribute(t *testing.T) { + ht, err := New(&DefaultOptions) + require.Nil(t, err) + + html := ` +
+ +
+ ` + response := &Response{Raw: html, Data: []byte(html)} + bd := ht.BodyDomainGrab(response) + + require.Contains(t, bd.Fqdns, "formaction-btn.example.com") +} + +func TestEdgeCase_CiteAttribute(t *testing.T) { + ht, err := New(&DefaultOptions) + require.Nil(t, err) + + html := ` +
quoted text
+ ` + response := &Response{Raw: html, Data: []byte(html)} + bd := ht.BodyDomainGrab(response) + + require.Contains(t, bd.Fqdns, "cite-source.example.com") +} + +func TestEdgeCase_OpenGraphAndTwitterMeta(t *testing.T) { + ht, err := New(&DefaultOptions) + require.Nil(t, err) + + html := ` + + + + ` + response := &Response{Raw: html, Data: []byte(html)} + bd := ht.BodyDomainGrab(response) + + require.Contains(t, bd.Fqdns, "og-url.example.com") + require.Contains(t, bd.Fqdns, "og-image.example.net") + require.Contains(t, bd.Fqdns, "twitter-img.example.org") +} + +func TestEdgeCase_SrcsetMultipleEntries(t *testing.T) { + ht, err := New(&DefaultOptions) + require.Nil(t, err) + + html := ` + + ` + response := &Response{Raw: html, Data: []byte(html)} + bd := ht.BodyDomainGrab(response) + + require.Contains(t, bd.Fqdns, "srcset1.example.com") + require.Contains(t, bd.Fqdns, "srcset2.example.net") + require.Contains(t, bd.Fqdns, "srcset3.example.org") +} + +func TestEdgeCase_DataAttributes(t *testing.T) { + ht, err := New(&DefaultOptions) + require.Nil(t, err) + + html := ` +
+
+ ` + response := &Response{Raw: html, Data: []byte(html)} + bd := ht.BodyDomainGrab(response) + + require.Contains(t, bd.Fqdns, "data-url-attr.example.com") + require.Contains(t, bd.Fqdns, "data-href-attr.example.net") +} + +func TestEdgeCase_LargeBodyNoPanic(t *testing.T) { + ht, err := New(&DefaultOptions) + require.Nil(t, err) + + // generate a large body with repeated content + var builder strings.Builder + builder.WriteString("") + for i := 0; i < 1000; i++ { + builder.WriteString(`link`) + } + builder.WriteString("") + body := builder.String() + + response := &Response{Raw: body, Data: []byte(body)} + bd := ht.BodyDomainGrab(response) + + require.NotNil(t, bd) + require.Contains(t, bd.Fqdns, "bulk.example.com") +} + +func TestEdgeCase_OnlyRawNoData(t *testing.T) { + ht, err := New(&DefaultOptions) + require.Nil(t, err) + + // r.Data is nil but r.Raw has content — HTML parser skipped, regex catches it + raw := `HTTP/1.1 200 OK\r\nContent-Type: text/html\r\n\r\ntest` + response := &Response{Raw: raw, Data: nil} + bd := ht.BodyDomainGrab(response) + + require.Contains(t, bd.Fqdns, "raw-only.example.com") +} + +func TestEdgeCase_SubdomainVsDomain(t *testing.T) { + ht, err := New(&DefaultOptions) + require.Nil(t, err) + + html := ` + root domain + subdomain + deep sub + ` + response := &Response{Raw: html, Data: []byte(html)} + bd := ht.BodyDomainGrab(response) + + require.Contains(t, bd.Domains, "example.com") + require.Contains(t, bd.Fqdns, "sub.example.com") + require.Contains(t, bd.Fqdns, "deep.sub.example.com") + // root domain (example.com) should be in domains but NOT in fqdns + // (because d == val for a root domain, so the fqdn branch is skipped) + for _, f := range bd.Fqdns { + require.NotEqual(t, "example.com", f, "root domain should not appear in fqdns list") + } +} + +func TestEdgeCase_InternationalTLDs(t *testing.T) { + ht, err := New(&DefaultOptions) + require.Nil(t, err) + + html := ` + uk + au + ` + response := &Response{Raw: html, Data: []byte(html)} + bd := ht.BodyDomainGrab(response) + + require.Contains(t, bd.Fqdns, "test.example.co.uk") + require.Contains(t, bd.Fqdns, "test.example.com.au") +} + +// helper for IP check test +func isAllNumericParts(d string) bool { + for _, part := range strings.Split(d, ".") { + allDigits := true + for _, c := range part { + if c < '0' || c > '9' { + allDigits = false + break + } + } + if !allDigits { + return false + } + } + return true +} + +// --- Unit tests for hostnameFromURL --- + +func TestHostnameFromURL(t *testing.T) { + tests := []struct { + name string + input string + expected string + }{ + {"https url", "https://example.com/path", "example.com"}, + {"http url", "http://sub.example.com/path", "sub.example.com"}, + {"protocol-relative", "//cdn.example.com/file.js", "cdn.example.com"}, + {"with port", "https://example.com:8443/api", "example.com"}, + {"with auth", "https://user:pass@example.com/page", "example.com"}, + {"with query", "https://example.com/path?q=1", "example.com"}, + {"with fragment", "https://example.com/path#section", "example.com"}, + {"empty string", "", ""}, + {"hash only", "#section", ""}, + {"javascript scheme", "javascript:void(0)", ""}, + {"data uri", "data:text/html,

hi

", ""}, + {"mailto", "mailto:user@example.com", ""}, + {"tel", "tel:+1234567890", ""}, + {"blob", "blob:https://example.com/uuid", ""}, + {"about", "about:blank", ""}, + {"relative path", "/path/to/page", ""}, + {"bare domain no scheme", "example.com", ""}, + {"no dots", "https://localhost/path", ""}, + {"ip address", "https://192.168.1.1/admin", "192.168.1.1"}, + {"uppercase scheme", "HTTPS://EXAMPLE.COM/PATH", "EXAMPLE.COM"}, + {"whitespace", " https://trimmed.example.com/path ", "trimmed.example.com"}, + } + + for _, tc := range tests { + t.Run(tc.name, func(t *testing.T) { + result := hostnameFromURL(tc.input) + require.Equal(t, tc.expected, result) + }) + } +} + +// --- Unit tests for addDomainCandidate --- + +func TestAddDomainCandidate(t *testing.T) { + t.Run("valid fqdn", func(t *testing.T) { + domains := make(map[string]struct{}) + fqdns := make(map[string]struct{}) + addDomainCandidate("sub.example.com", domains, fqdns, "") + require.Contains(t, fqdns, "sub.example.com") + require.Contains(t, domains, "example.com") + }) + + t.Run("root domain only goes to domains not fqdns", func(t *testing.T) { + domains := make(map[string]struct{}) + fqdns := make(map[string]struct{}) + addDomainCandidate("example.com", domains, fqdns, "") + require.Contains(t, domains, "example.com") + require.Empty(t, fqdns) + }) + + t.Run("trailing dot is stripped", func(t *testing.T) { + domains := make(map[string]struct{}) + fqdns := make(map[string]struct{}) + addDomainCandidate("sub.example.com.", domains, fqdns, "") + require.Contains(t, fqdns, "sub.example.com") + }) + + t.Run("uppercase is lowered", func(t *testing.T) { + domains := make(map[string]struct{}) + fqdns := make(map[string]struct{}) + addDomainCandidate("SUB.EXAMPLE.COM", domains, fqdns, "") + require.Contains(t, fqdns, "sub.example.com") + }) + + t.Run("input domain excluded from domains", func(t *testing.T) { + domains := make(map[string]struct{}) + fqdns := make(map[string]struct{}) + addDomainCandidate("sub.example.com", domains, fqdns, "example.com") + require.Empty(t, domains) + require.Contains(t, fqdns, "sub.example.com") + }) + + t.Run("input fqdn excluded from fqdns", func(t *testing.T) { + domains := make(map[string]struct{}) + fqdns := make(map[string]struct{}) + addDomainCandidate("sub.example.com", domains, fqdns, "sub.example.com") + require.Empty(t, fqdns) + }) + + t.Run("empty string rejected", func(t *testing.T) { + domains := make(map[string]struct{}) + fqdns := make(map[string]struct{}) + addDomainCandidate("", domains, fqdns, "") + require.Empty(t, domains) + require.Empty(t, fqdns) + }) + + t.Run("whitespace only rejected", func(t *testing.T) { + domains := make(map[string]struct{}) + fqdns := make(map[string]struct{}) + addDomainCandidate(" ", domains, fqdns, "") + require.Empty(t, domains) + require.Empty(t, fqdns) + }) + + t.Run("ip address rejected", func(t *testing.T) { + domains := make(map[string]struct{}) + fqdns := make(map[string]struct{}) + addDomainCandidate("192.168.1.1", domains, fqdns, "") + require.Empty(t, domains) + require.Empty(t, fqdns) + }) + + t.Run("single label rejected", func(t *testing.T) { + domains := make(map[string]struct{}) + fqdns := make(map[string]struct{}) + addDomainCandidate("localhost", domains, fqdns, "") + require.Empty(t, domains) + require.Empty(t, fqdns) + }) +} + +// --- Benchmarks --- + +func BenchmarkBodyDomainGrab_HackerOne(b *testing.B) { + ht, err := New(&DefaultOptions) + if err != nil { + b.Fatal(err) + } + response := &Response{ + Raw: rawResponse, + Data: []byte(rawResponse), + } + b.ResetTimer() + for i := 0; i < b.N; i++ { + ht.BodyDomainGrab(response) + } +} + +func BenchmarkBodyDomainGrab_SmallPage(b *testing.B) { + ht, err := New(&DefaultOptions) + if err != nil { + b.Fatal(err) + } + response := &Response{ + Raw: sampleWithJS, + Data: []byte(sampleWithJS), + } + b.ResetTimer() + for i := 0; i < b.N; i++ { + ht.BodyDomainGrab(response) + } +} + +func BenchmarkBodyDomainGrab_RegexOnly(b *testing.B) { + response := &Response{ + Raw: rawResponse, + Data: []byte(rawResponse), + } + b.ResetTimer() + for i := 0; i < b.N; i++ { + domains := make(map[string]struct{}) + fqdns := make(map[string]struct{}) + extractDomainsFromRegex(response.Raw, domains, fqdns, "") + } +} + +func BenchmarkBodyDomainGrab_HTMLOnly(b *testing.B) { + b.ResetTimer() + for i := 0; i < b.N; i++ { + domains := make(map[string]struct{}) + fqdns := make(map[string]struct{}) + extractDomainsFromHTML([]byte(rawResponse), domains, fqdns, "") + } +} + +func BenchmarkBodyDomainGrab_JSOnly(b *testing.B) { + scripts := []string{} + extractDomainsFromHTML([]byte(rawResponse), make(map[string]struct{}), make(map[string]struct{}), "") + doc, _ := goquery.NewDocumentFromReader(bytes.NewReader([]byte(rawResponse))) + doc.Find("script").Each(func(_ int, s *goquery.Selection) { + if _, ok := s.Attr("src"); !ok { + if text := s.Text(); strings.TrimSpace(text) != "" { + scripts = append(scripts, text) + } + } + }) + b.ResetTimer() + for i := 0; i < b.N; i++ { + for _, script := range scripts { + domains := make(map[string]struct{}) + fqdns := make(map[string]struct{}) + extractDomainsFromJS(script, domains, fqdns, "") + } + } +} + +func BenchmarkBodyDomainGrab_JSON(b *testing.B) { + ht, err := New(&DefaultOptions) + if err != nil { + b.Fatal(err) + } + json := `{"url":"https://api.example.com/v1","cdn":"https://cdn.example.net/assets","callback":"https://hooks.example.org/notify"}` + response := &Response{ + Raw: json, + Data: []byte(json), + } + b.ResetTimer() + for i := 0; i < b.N; i++ { + ht.BodyDomainGrab(response) + } +} + +func BenchmarkBodyDomainGrab_PlainText(b *testing.B) { + ht, err := New(&DefaultOptions) + if err != nil { + b.Fatal(err) + } + text := `'api.example.com' and 'cdn.example.net' are the endpoints` + response := &Response{ + Raw: text, + Data: []byte(text), + } + b.ResetTimer() + for i := 0; i < b.N; i++ { + ht.BodyDomainGrab(response) + } +} diff --git a/common/httpx/test-data/sample_with_js.html b/common/httpx/test-data/sample_with_js.html new file mode 100644 index 000000000..93b7eab19 --- /dev/null +++ b/common/httpx/test-data/sample_with_js.html @@ -0,0 +1,52 @@ + + + + Test Page + + + + + + + Link + Another + Relative + Hash + JS + + photo + +
+ +
+ + + +
+ + + + + + + + Text with a bare domain like bare.textdomain.example.com mentioned here. + + diff --git a/go.mod b/go.mod index a5791088f..226dfe71e 100644 --- a/go.mod +++ b/go.mod @@ -50,6 +50,7 @@ require ( ) require ( + github.com/dop251/goja v0.0.0-20260311135729-065cd970411c github.com/dustin/go-humanize v1.0.1 github.com/go-sql-driver/mysql v1.9.3 github.com/go-viper/mapstructure/v2 v2.5.0 @@ -97,6 +98,7 @@ require ( github.com/felixge/fgprof v0.9.5 // indirect github.com/gaissmai/bart v0.26.0 // indirect github.com/go-ole/go-ole v1.2.6 // indirect + github.com/go-sourcemap/sourcemap v2.1.3+incompatible // indirect github.com/google/certificate-transparency-go v1.3.2 // indirect github.com/google/go-github/v30 v30.1.0 // indirect github.com/google/go-querystring v1.1.0 // indirect diff --git a/go.sum b/go.sum index 3903a95c9..20c1b59c3 100644 --- a/go.sum +++ b/go.sum @@ -111,6 +111,8 @@ github.com/dlclark/regexp2 v1.11.5 h1:Q/sSnsKerHeCkc/jSTNq1oCm7KiVgUMZRDUoRu0JQZ github.com/dlclark/regexp2 v1.11.5/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8= github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4= github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk= +github.com/dop251/goja v0.0.0-20260311135729-065cd970411c h1:OcLmPfx1T1RmZVHHFwWMPaZDdRf0DBMZOFMVWJa7Pdk= +github.com/dop251/goja v0.0.0-20260311135729-065cd970411c/go.mod h1:MxLav0peU43GgvwVgNbLAj1s/bSGboKkhuULvq/7hx4= github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 h1:2tV76y6Q9BB+NEBasnqvs7e49aEBFI8ejC89PSnWH+4= github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707/go.mod h1:qssHWj60/X5sZFNxpG4HBPDHVqxNm4DfnCKgrbZOT+s= github.com/dsnet/golib v0.0.0-20171103203638-1ea166775780/go.mod h1:Lj+Z9rebOhdfkVLjJ8T6VcRQv3SXugXy999NBtR9aFY= @@ -137,6 +139,8 @@ github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY= github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0= github.com/go-rod/rod v0.116.2 h1:A5t2Ky2A+5eD/ZJQr1EfsQSe5rms5Xof/qj296e+ZqA= github.com/go-rod/rod v0.116.2/go.mod h1:H+CMO9SCNc2TJ2WfrG+pKhITz57uGNYU43qYHh438Mg= +github.com/go-sourcemap/sourcemap v2.1.3+incompatible h1:W1iEw64niKVGogNgBN3ePyLFfuisuzeidWPMPWmECqU= +github.com/go-sourcemap/sourcemap v2.1.3+incompatible/go.mod h1:F8jJfvm2KbVjc5NqelyYJmf/v5J0dwNLS2mL4sNA1Jg= github.com/go-sql-driver/mysql v1.9.3 h1:U/N249h2WzJ3Ukj8SowVFjdtZKfu9vlLZxjPXV1aweo= github.com/go-sql-driver/mysql v1.9.3/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU= github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro= From c3b06b505f80970d4b328db31cf9ca00a4c701fc Mon Sep 17 00:00:00 2001 From: Mzack9999 Date: Sat, 21 Mar 2026 18:54:07 +0100 Subject: [PATCH 02/32] fixing lint --- common/httpx/domains.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/common/httpx/domains.go b/common/httpx/domains.go index d705fb008..76da3b700 100644 --- a/common/httpx/domains.go +++ b/common/httpx/domains.go @@ -148,7 +148,9 @@ func extractDomainsFromJS(script string, domains, fqdns map[string]struct{}, inp if err != nil { return } - defer func() { recover() }() + defer func() { + _ = recover() + }() walkProgram(program, func(value string) { for _, match := range potentialDomainsCompiled.FindAllStringSubmatch(value, -1) { if len(match) >= 2 { From 788e10e052c430d57751fa6f5d535eebc3ed284f Mon Sep 17 00:00:00 2001 From: Mzack9999 Date: Sun, 22 Mar 2026 12:57:08 +0100 Subject: [PATCH 03/32] improving impersonate --- README.md | 2 +- cmd/functional-test/testcases.txt | 2 +- common/httpx/httpx.go | 40 ++- common/httpx/option.go | 2 +- common/httpx/tls_impersonate_test.go | 408 +++++++++++++++++++++++++++ go.mod | 2 +- go.sum | 4 +- runner/options.go | 4 +- 8 files changed, 450 insertions(+), 14 deletions(-) create mode 100644 common/httpx/tls_impersonate_test.go diff --git a/README.md b/README.md index 5dddd7379..d70d1047a 100644 --- a/README.md +++ b/README.md @@ -238,7 +238,7 @@ CONFIGURATIONS: -ldp, -leave-default-ports leave default http/https ports in host header (eg. http://host:80 - https://host:443 -ztls use ztls library with autofallback to standard one for tls13 -no-decode avoid decoding body - -tlsi, -tls-impersonate enable experimental client hello (ja3) tls randomization + -tlsi, -tls-impersonate string enable experimental client hello (ja3) tls impersonation (random, chrome, or ja3 full string) -no-stdin Disable Stdin processing -hae, -http-api-endpoint string experimental http api endpoint -sf, -secret-file string path to secret file for authentication diff --git a/cmd/functional-test/testcases.txt b/cmd/functional-test/testcases.txt index 34a53b4ce..0cdf3268f 100644 --- a/cmd/functional-test/testcases.txt +++ b/cmd/functional-test/testcases.txt @@ -19,5 +19,5 @@ scanme.sh {{binary}} -silent -ztls scanme.sh {{binary}} -silent -jarm https://scanme.sh?a=1*1 {{binary}} -silent https://scanme.sh:443 {{binary}} -asn -scanme.sh {{binary}} -silent -tls-impersonate +scanme.sh {{binary}} -silent -tls-impersonate random example.com {{binary}} -silent -bp -strip \ No newline at end of file diff --git a/common/httpx/httpx.go b/common/httpx/httpx.go index 821988870..b6ac7f9d6 100644 --- a/common/httpx/httpx.go +++ b/common/httpx/httpx.go @@ -16,6 +16,7 @@ import ( "github.com/microcosm-cc/bluemonday" "github.com/projectdiscovery/cdncheck" "github.com/projectdiscovery/fastdialer/fastdialer" + "github.com/projectdiscovery/fastdialer/fastdialer/ja3" "github.com/projectdiscovery/fastdialer/fastdialer/ja3/impersonate" "github.com/projectdiscovery/httpx/common/httputilz" "github.com/projectdiscovery/networkpolicy" @@ -139,12 +140,7 @@ func New(options *Options) (*HTTPX, error) { } transport := &http.Transport{ DialContext: httpx.Dialer.Dial, - DialTLSContext: func(ctx context.Context, network, addr string) (net.Conn, error) { - if options.TlsImpersonate { - return httpx.Dialer.DialTLSWithConfigImpersonate(ctx, network, addr, &tls.Config{InsecureSkipVerify: true, MinVersion: tls.VersionTLS10}, impersonate.Random, nil) - } - return httpx.Dialer.DialTLS(ctx, network, addr) - }, + DialTLSContext: httpx.buildTLSDialer(options), MaxIdleConnsPerHost: -1, TLSClientConfig: &tls.Config{ InsecureSkipVerify: true, @@ -216,6 +212,38 @@ func New(options *Options) (*HTTPX, error) { return httpx, nil } +func (h *HTTPX) buildTLSDialer(options *Options) func(ctx context.Context, network, addr string) (net.Conn, error) { + if options.TlsImpersonate == "" { + return func(ctx context.Context, network, addr string) (net.Conn, error) { + return h.Dialer.DialTLS(ctx, network, addr) + } + } + + tlsCfg := &tls.Config{InsecureSkipVerify: true, MinVersion: tls.VersionTLS10} + + strategy, identity := resolveImpersonateStrategy(options.TlsImpersonate) + + return func(ctx context.Context, network, addr string) (net.Conn, error) { + return h.Dialer.DialTLSWithConfigImpersonate(ctx, network, addr, tlsCfg, strategy, identity) + } +} + +func resolveImpersonateStrategy(value string) (impersonate.Strategy, *impersonate.Identity) { + switch strings.ToLower(value) { + case "", "random": + return impersonate.Random, nil + case "chrome": + return impersonate.Chrome, nil + default: + spec, err := ja3.ParseWithJa3(value) + if err != nil { + return impersonate.Random, nil + } + identity := impersonate.Identity(*spec) + return impersonate.Custom, &identity + } +} + // Do http request func (h *HTTPX) Do(req *retryablehttp.Request, unsafeOptions UnsafeOptions) (*Response, error) { timeStart := time.Now() diff --git a/common/httpx/option.go b/common/httpx/option.go index fb1087296..bd47f1674 100644 --- a/common/httpx/option.go +++ b/common/httpx/option.go @@ -58,7 +58,7 @@ type Options struct { Resolvers []string customCookies []*http.Cookie SniName string - TlsImpersonate bool + TlsImpersonate string NetworkPolicy *networkpolicy.NetworkPolicy CDNCheckClient *cdncheck.Client Protocol Proto diff --git a/common/httpx/tls_impersonate_test.go b/common/httpx/tls_impersonate_test.go new file mode 100644 index 000000000..c406975f7 --- /dev/null +++ b/common/httpx/tls_impersonate_test.go @@ -0,0 +1,408 @@ +package httpx + +import ( + "context" + "crypto/ecdsa" + "crypto/elliptic" + "crypto/rand" + "crypto/tls" + "crypto/x509" + "crypto/x509/pkix" + "math/big" + "net" + "sync" + "testing" + "time" + + "github.com/projectdiscovery/fastdialer/fastdialer" + "github.com/projectdiscovery/fastdialer/fastdialer/ja3/impersonate" + "github.com/stretchr/testify/require" +) + +// capturedHello holds the ClientHello details captured by the test TLS server. +type capturedHello struct { + CipherSuites []uint16 + SupportedCurves []tls.CurveID + ServerName string + SupportedProtos []string +} + +// startTLSServer creates a local TLS server that captures ClientHello info +// from each incoming connection. It returns the listener address and a function +// to retrieve the most recently captured hello. +func startTLSServer(t *testing.T) (string, func() *capturedHello) { + t.Helper() + + key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader) + require.NoError(t, err) + + template := &x509.Certificate{ + SerialNumber: big.NewInt(1), + Subject: pkix.Name{CommonName: "localhost"}, + NotBefore: time.Now(), + NotAfter: time.Now().Add(time.Hour), + KeyUsage: x509.KeyUsageDigitalSignature, + ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth}, + IPAddresses: []net.IP{net.ParseIP("127.0.0.1")}, + DNSNames: []string{"localhost"}, + } + certDER, err := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key) + require.NoError(t, err) + + cert := tls.Certificate{ + Certificate: [][]byte{certDER}, + PrivateKey: key, + } + + var mu sync.Mutex + var latest *capturedHello + + tlsCfg := &tls.Config{ + Certificates: []tls.Certificate{cert}, + GetConfigForClient: func(info *tls.ClientHelloInfo) (*tls.Config, error) { + hello := &capturedHello{ + CipherSuites: info.CipherSuites, + SupportedCurves: info.SupportedCurves, + ServerName: info.ServerName, + SupportedProtos: info.SupportedProtos, + } + mu.Lock() + latest = hello + mu.Unlock() + return nil, nil + }, + } + + ln, err := tls.Listen("tcp", "127.0.0.1:0", tlsCfg) + require.NoError(t, err) + t.Cleanup(func() { + ln.Close() + }) + + go func() { + for { + conn, err := ln.Accept() + if err != nil { + return + } + go func() { + defer conn.Close() + buf := make([]byte, 1) + conn.Read(buf) + }() + } + }() + + getHello := func() *capturedHello { + mu.Lock() + defer mu.Unlock() + return latest + } + + return ln.Addr().String(), getHello +} + +// --- Unit tests for resolveImpersonateStrategy --- + +func TestResolveImpersonateStrategy(t *testing.T) { + t.Run("empty defaults to random", func(t *testing.T) { + strategy, identity := resolveImpersonateStrategy("") + require.Equal(t, impersonate.Random, strategy) + require.Nil(t, identity) + }) + + t.Run("random", func(t *testing.T) { + strategy, identity := resolveImpersonateStrategy("random") + require.Equal(t, impersonate.Random, strategy) + require.Nil(t, identity) + }) + + t.Run("random case insensitive", func(t *testing.T) { + strategy, identity := resolveImpersonateStrategy("Random") + require.Equal(t, impersonate.Random, strategy) + require.Nil(t, identity) + }) + + t.Run("chrome", func(t *testing.T) { + strategy, identity := resolveImpersonateStrategy("chrome") + require.Equal(t, impersonate.Chrome, strategy) + require.Nil(t, identity) + }) + + t.Run("chrome case insensitive", func(t *testing.T) { + strategy, identity := resolveImpersonateStrategy("CHROME") + require.Equal(t, impersonate.Chrome, strategy) + require.Nil(t, identity) + }) + + t.Run("valid ja3 string", func(t *testing.T) { + ja3str := "771,49195-49196,0-23-65281-10-11-35-16-5-13-18,23-24,0" + strategy, identity := resolveImpersonateStrategy(ja3str) + require.Equal(t, impersonate.Custom, strategy) + require.NotNil(t, identity) + }) + + t.Run("invalid ja3 falls back to random", func(t *testing.T) { + strategy, identity := resolveImpersonateStrategy("not-a-ja3-string") + require.Equal(t, impersonate.Random, strategy) + require.Nil(t, identity) + }) + + t.Run("partial ja3 falls back to random", func(t *testing.T) { + strategy, identity := resolveImpersonateStrategy("771,4865") + require.Equal(t, impersonate.Random, strategy) + require.Nil(t, identity) + }) +} + +// Integration tests with local TLS server + +func TestTLSImpersonate_DefaultGoTLS(t *testing.T) { + addr, getHello := startTLSServer(t) + + opts := fastdialer.DefaultOptions + opts.EnableFallback = false + fd, err := fastdialer.NewDialer(opts) + require.NoError(t, err) + defer fd.Close() + + conn, err := fd.DialTLSWithConfigImpersonate( + context.Background(), "tcp", addr, + &tls.Config{InsecureSkipVerify: true}, + impersonate.None, nil, + ) + require.NoError(t, err) + conn.Close() + + hello := getHello() + require.NotNil(t, hello) + require.NotEmpty(t, hello.CipherSuites, "default Go TLS should have cipher suites") +} + +func TestTLSImpersonate_Random(t *testing.T) { + addr, getHello := startTLSServer(t) + + opts := fastdialer.DefaultOptions + opts.EnableFallback = false + fd, err := fastdialer.NewDialer(opts) + require.NoError(t, err) + defer fd.Close() + + conn, err := fd.DialTLSWithConfigImpersonate( + context.Background(), "tcp", addr, + &tls.Config{InsecureSkipVerify: true}, + impersonate.Random, nil, + ) + require.NoError(t, err) + conn.Close() + + hello := getHello() + require.NotNil(t, hello) + require.NotEmpty(t, hello.CipherSuites, "random impersonation should have cipher suites") +} + +func TestTLSImpersonate_Chrome(t *testing.T) { + addr, getHello := startTLSServer(t) + + opts := fastdialer.DefaultOptions + opts.EnableFallback = false + fd, err := fastdialer.NewDialer(opts) + require.NoError(t, err) + defer fd.Close() + + conn, err := fd.DialTLSWithConfigImpersonate( + context.Background(), "tcp", addr, + &tls.Config{InsecureSkipVerify: true}, + impersonate.Chrome, nil, + ) + require.NoError(t, err) + conn.Close() + + hello := getHello() + require.NotNil(t, hello) + require.NotEmpty(t, hello.CipherSuites) + // Chrome 106 uses GREASE values (0xNANA pattern) as the first cipher suite + hasGrease := false + for _, cs := range hello.CipherSuites { + if cs&0x0f0f == 0x0a0a { + hasGrease = true + break + } + } + require.True(t, hasGrease, "Chrome impersonation should include GREASE cipher suite values") +} + +func TestTLSImpersonate_CustomJA3(t *testing.T) { + addr, getHello := startTLSServer(t) + + ja3Str := "771,49195-49196,0-23-65281-10-11-35-16-5-13-18,23-24,0" + strategy, identity := resolveImpersonateStrategy(ja3Str) + require.Equal(t, impersonate.Custom, strategy) + require.NotNil(t, identity) + + opts := fastdialer.DefaultOptions + opts.EnableFallback = false + fd, err := fastdialer.NewDialer(opts) + require.NoError(t, err) + defer fd.Close() + + conn, err := fd.DialTLSWithConfigImpersonate( + context.Background(), "tcp", addr, + &tls.Config{InsecureSkipVerify: true}, + strategy, identity, + ) + require.NoError(t, err) + require.NotNil(t, conn) + conn.Close() + + hello := getHello() + require.NotNil(t, hello) + + require.Equal(t, []uint16{49195, 49196}, hello.CipherSuites, + "custom JA3 should contain exactly the specified cipher suites") + + expectedCurves := []tls.CurveID{23, 24} + require.Equal(t, expectedCurves, hello.SupportedCurves, + "custom JA3 should contain exactly the specified curves") +} + +func TestTLSImpersonate_ChromeDiffersFromDefault(t *testing.T) { + addr, getHello := startTLSServer(t) + + opts := fastdialer.DefaultOptions + opts.EnableFallback = false + fd, err := fastdialer.NewDialer(opts) + require.NoError(t, err) + defer fd.Close() + + // Default (no impersonation) + conn, err := fd.DialTLSWithConfigImpersonate( + context.Background(), "tcp", addr, + &tls.Config{InsecureSkipVerify: true}, + impersonate.None, nil, + ) + require.NoError(t, err) + conn.Close() + defaultHello := getHello() + + // Chrome + conn, err = fd.DialTLSWithConfigImpersonate( + context.Background(), "tcp", addr, + &tls.Config{InsecureSkipVerify: true}, + impersonate.Chrome, nil, + ) + require.NoError(t, err) + conn.Close() + chromeHello := getHello() + + require.NotNil(t, defaultHello) + require.NotNil(t, chromeHello) + + // Chrome should have more cipher suites than Go's default (includes GREASE + broader set) + require.NotEqual(t, defaultHello.CipherSuites, chromeHello.CipherSuites, + "Chrome impersonation should produce different cipher suites than default Go TLS") +} + +func TestTLSImpersonate_CustomJA3DiffersFromDefault(t *testing.T) { + addr, getHello := startTLSServer(t) + + opts := fastdialer.DefaultOptions + opts.EnableFallback = false + fd, err := fastdialer.NewDialer(opts) + require.NoError(t, err) + defer fd.Close() + + // Default (no impersonation) + conn, err := fd.DialTLSWithConfigImpersonate( + context.Background(), "tcp", addr, + &tls.Config{InsecureSkipVerify: true}, + impersonate.None, nil, + ) + require.NoError(t, err) + conn.Close() + defaultHello := getHello() + + ja3Str := "771,49195-49196,0-23-65281-10-11-35-16-5-13-18,23-24,0" + strategy, identity := resolveImpersonateStrategy(ja3Str) + require.Equal(t, impersonate.Custom, strategy) + + conn, err = fd.DialTLSWithConfigImpersonate( + context.Background(), "tcp", addr, + &tls.Config{InsecureSkipVerify: true}, + strategy, identity, + ) + require.NoError(t, err) + conn.Close() + customHello := getHello() + + require.NotNil(t, defaultHello) + require.NotNil(t, customHello) + + require.NotEqual(t, defaultHello.CipherSuites, customHello.CipherSuites, + "custom JA3 should produce different cipher suites than default Go TLS") +} + +func TestTLSImpersonate_EndToEnd_HTTPX(t *testing.T) { + addr, getHello := startTLSServer(t) + + tests := []struct { + name string + strategy string + wantErr bool + }{ + {"disabled", "", false}, + {"random", "random", false}, + {"chrome", "chrome", false}, + {"ja3", "771,49195-49196,0-23-65281-10-11-35-16-5-13-18,23-24,0", false}, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + options := DefaultOptions + options.TlsImpersonate = tt.strategy + + ht, err := New(&options) + require.NoError(t, err) + + dialer := ht.buildTLSDialer(&options) + conn, err := dialer(context.Background(), "tcp", addr) + if tt.wantErr { + require.Error(t, err) + return + } + require.NoError(t, err) + require.NotNil(t, conn) + conn.Close() + + if tt.strategy != "" { + hello := getHello() + require.NotNil(t, hello) + require.NotEmpty(t, hello.CipherSuites) + } + }) + } +} + +func TestTLSImpersonate_EndToEnd_JA3(t *testing.T) { + addr, getHello := startTLSServer(t) + + ja3Str := "771,49195-49196,0-23-65281-10-11-35-16-5-13-18,23-24,0" + options := DefaultOptions + options.TlsImpersonate = ja3Str + + ht, err := New(&options) + require.NoError(t, err) + + dialer := ht.buildTLSDialer(&options) + conn, err := dialer(context.Background(), "tcp", addr) + require.NoError(t, err) + require.NotNil(t, conn) + conn.Close() + + hello := getHello() + require.NotNil(t, hello) + + require.Equal(t, []uint16{49195, 49196}, hello.CipherSuites, + "JA3 end-to-end cipher suites should match exactly") + require.Equal(t, []tls.CurveID{23, 24}, hello.SupportedCurves, + "JA3 end-to-end curves should match exactly") +} diff --git a/go.mod b/go.mod index a5791088f..91e1b1ef3 100644 --- a/go.mod +++ b/go.mod @@ -22,7 +22,7 @@ require ( github.com/projectdiscovery/cdncheck v1.2.27 github.com/projectdiscovery/clistats v0.1.1 github.com/projectdiscovery/dsl v0.8.13 - github.com/projectdiscovery/fastdialer v0.5.4 + github.com/projectdiscovery/fastdialer v0.5.6-0.20260322114839-243754103eca github.com/projectdiscovery/fdmax v0.0.4 github.com/projectdiscovery/goconfig v0.0.1 github.com/projectdiscovery/goflags v0.1.74 diff --git a/go.sum b/go.sum index 3903a95c9..d6e4bd7ff 100644 --- a/go.sum +++ b/go.sum @@ -332,8 +332,8 @@ github.com/projectdiscovery/clistats v0.1.1 h1:8mwbdbwTU4aT88TJvwIzTpiNeow3XnAB7 github.com/projectdiscovery/clistats v0.1.1/go.mod h1:4LtTC9Oy//RiuT1+76MfTg8Hqs7FQp1JIGBM3nHK6a0= github.com/projectdiscovery/dsl v0.8.13 h1:HjjHta7c02saH2tUGs8CN5vDeE2MyWvCV32koT8ZCWs= github.com/projectdiscovery/dsl v0.8.13/go.mod h1:hgFaXhz/JuO+HqIXqBqYIR3ntPnqTo38MJJAzb5tIbg= -github.com/projectdiscovery/fastdialer v0.5.4 h1:+0oesDDqZcIPE5bNDmm/Xm9Xm3yjnhl4xwP+h5D1TE4= -github.com/projectdiscovery/fastdialer v0.5.4/go.mod h1:KCzt6WnSAj9umiUBRCaC0EJSEyeshxDoowfwjxodmQw= +github.com/projectdiscovery/fastdialer v0.5.6-0.20260322114839-243754103eca h1:g7uHD+yWd6owMn5GFnCLuQN+f1P11kSK508OyKIlIyI= +github.com/projectdiscovery/fastdialer v0.5.6-0.20260322114839-243754103eca/go.mod h1:QxvCe02Jii+j8vA3hWYkymgZIY8cqMgs2s3Jbz6mvbs= github.com/projectdiscovery/fdmax v0.0.4 h1:K9tIl5MUZrEMzjvwn/G4drsHms2aufTn1xUdeVcmhmc= github.com/projectdiscovery/fdmax v0.0.4/go.mod h1:oZLqbhMuJ5FmcoaalOm31B1P4Vka/CqP50nWjgtSz+I= github.com/projectdiscovery/freeport v0.0.7 h1:Q6uXo/j8SaV/GlAHkEYQi8WQoPXyJWxyspx+aFmz9Qk= diff --git a/runner/options.go b/runner/options.go index d12a7dad5..385e0de7e 100644 --- a/runner/options.go +++ b/runner/options.go @@ -331,7 +331,7 @@ type Options struct { NoDecode bool Screenshot bool UseInstalledChrome bool - TlsImpersonate bool + TlsImpersonate string DisableStdin bool HttpApiEndpoint string NoScreenshotBytes bool @@ -547,7 +547,7 @@ func ParseOptions() *Options { flagSet.BoolVarP(&options.LeaveDefaultPorts, "leave-default-ports", "ldp", false, "leave default http/https ports in host header (eg. http://host:80 - https://host:443"), flagSet.BoolVar(&options.ZTLS, "ztls", false, "use ztls library with autofallback to standard one for tls13"), flagSet.BoolVar(&options.NoDecode, "no-decode", false, "avoid decoding body"), - flagSet.BoolVarP(&options.TlsImpersonate, "tls-impersonate", "tlsi", false, "enable experimental client hello (ja3) tls randomization"), + flagSet.StringVarP(&options.TlsImpersonate, "tls-impersonate", "tlsi", "", "enable experimental client hello (ja3) tls impersonation (random, chrome, or ja3 full string)"), flagSet.BoolVar(&options.DisableStdin, "no-stdin", false, "Disable Stdin processing"), flagSet.StringVarP(&options.HttpApiEndpoint, "http-api-endpoint", "hae", "", "experimental http api endpoint"), flagSet.StringVarP(&options.SecretFile, "secret-file", "sf", "", "path to the secret file for authentication"), From 4586d67434c1a48be8947ac06a85a2bcb4214891 Mon Sep 17 00:00:00 2001 From: Mzack9999 Date: Sun, 22 Mar 2026 13:05:34 +0100 Subject: [PATCH 04/32] fixing lint --- common/httpx/tls_impersonate_test.go | 28 +++++++++++++++------------- 1 file changed, 15 insertions(+), 13 deletions(-) diff --git a/common/httpx/tls_impersonate_test.go b/common/httpx/tls_impersonate_test.go index c406975f7..b95467d68 100644 --- a/common/httpx/tls_impersonate_test.go +++ b/common/httpx/tls_impersonate_test.go @@ -76,7 +76,7 @@ func startTLSServer(t *testing.T) (string, func() *capturedHello) { ln, err := tls.Listen("tcp", "127.0.0.1:0", tlsCfg) require.NoError(t, err) t.Cleanup(func() { - ln.Close() + _ = ln.Close() }) go func() { @@ -86,9 +86,11 @@ func startTLSServer(t *testing.T) (string, func() *capturedHello) { return } go func() { - defer conn.Close() + defer func() { + _ = conn.Close() + }() buf := make([]byte, 1) - conn.Read(buf) + _, _ = conn.Read(buf) }() } }() @@ -172,7 +174,7 @@ func TestTLSImpersonate_DefaultGoTLS(t *testing.T) { impersonate.None, nil, ) require.NoError(t, err) - conn.Close() + _ = conn.Close() hello := getHello() require.NotNil(t, hello) @@ -194,7 +196,7 @@ func TestTLSImpersonate_Random(t *testing.T) { impersonate.Random, nil, ) require.NoError(t, err) - conn.Close() + _ = conn.Close() hello := getHello() require.NotNil(t, hello) @@ -216,7 +218,7 @@ func TestTLSImpersonate_Chrome(t *testing.T) { impersonate.Chrome, nil, ) require.NoError(t, err) - conn.Close() + _ = conn.Close() hello := getHello() require.NotNil(t, hello) @@ -253,7 +255,7 @@ func TestTLSImpersonate_CustomJA3(t *testing.T) { ) require.NoError(t, err) require.NotNil(t, conn) - conn.Close() + _ = conn.Close() hello := getHello() require.NotNil(t, hello) @@ -282,7 +284,7 @@ func TestTLSImpersonate_ChromeDiffersFromDefault(t *testing.T) { impersonate.None, nil, ) require.NoError(t, err) - conn.Close() + _ = conn.Close() defaultHello := getHello() // Chrome @@ -292,7 +294,7 @@ func TestTLSImpersonate_ChromeDiffersFromDefault(t *testing.T) { impersonate.Chrome, nil, ) require.NoError(t, err) - conn.Close() + _ = conn.Close() chromeHello := getHello() require.NotNil(t, defaultHello) @@ -319,7 +321,7 @@ func TestTLSImpersonate_CustomJA3DiffersFromDefault(t *testing.T) { impersonate.None, nil, ) require.NoError(t, err) - conn.Close() + _ = conn.Close() defaultHello := getHello() ja3Str := "771,49195-49196,0-23-65281-10-11-35-16-5-13-18,23-24,0" @@ -332,7 +334,7 @@ func TestTLSImpersonate_CustomJA3DiffersFromDefault(t *testing.T) { strategy, identity, ) require.NoError(t, err) - conn.Close() + _ = conn.Close() customHello := getHello() require.NotNil(t, defaultHello) @@ -371,7 +373,7 @@ func TestTLSImpersonate_EndToEnd_HTTPX(t *testing.T) { } require.NoError(t, err) require.NotNil(t, conn) - conn.Close() + _ = conn.Close() if tt.strategy != "" { hello := getHello() @@ -396,7 +398,7 @@ func TestTLSImpersonate_EndToEnd_JA3(t *testing.T) { conn, err := dialer(context.Background(), "tcp", addr) require.NoError(t, err) require.NotNil(t, conn) - conn.Close() + _ = conn.Close() hello := getHello() require.NotNil(t, hello) From 6a83a6b1cea198db4a64af99a6b1bbaa940f5a9b Mon Sep 17 00:00:00 2001 From: Mzack9999 Date: Wed, 25 Mar 2026 17:33:13 +0100 Subject: [PATCH 05/32] go.sum --- go.sum | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/go.sum b/go.sum index 22e85fe10..c4574382b 100644 --- a/go.sum +++ b/go.sum @@ -332,8 +332,8 @@ github.com/projectdiscovery/clistats v0.1.1 h1:8mwbdbwTU4aT88TJvwIzTpiNeow3XnAB7 github.com/projectdiscovery/clistats v0.1.1/go.mod h1:4LtTC9Oy//RiuT1+76MfTg8Hqs7FQp1JIGBM3nHK6a0= github.com/projectdiscovery/dsl v0.8.14 h1:g9szcXk2RRdVf2rsHEzbTXOPxiny3haKonSncU6pg2w= github.com/projectdiscovery/dsl v0.8.14/go.mod h1:LYImt/EiBzqTWG1RswT3Yl0DZbfjUP93Nvq2Z/G7dcE= -github.com/projectdiscovery/fastdialer v0.5.5 h1:KXmGuR1Op37umSvx4B0vxVSuC2a2DqD1oMqZ5l2bLEU= -github.com/projectdiscovery/fastdialer v0.5.5/go.mod h1:QxvCe02Jii+j8vA3hWYkymgZIY8cqMgs2s3Jbz6mvbs= +github.com/projectdiscovery/fastdialer v0.5.6-0.20260322114839-243754103eca h1:g7uHD+yWd6owMn5GFnCLuQN+f1P11kSK508OyKIlIyI= +github.com/projectdiscovery/fastdialer v0.5.6-0.20260322114839-243754103eca/go.mod h1:QxvCe02Jii+j8vA3hWYkymgZIY8cqMgs2s3Jbz6mvbs= github.com/projectdiscovery/fdmax v0.0.4 h1:K9tIl5MUZrEMzjvwn/G4drsHms2aufTn1xUdeVcmhmc= github.com/projectdiscovery/fdmax v0.0.4/go.mod h1:oZLqbhMuJ5FmcoaalOm31B1P4Vka/CqP50nWjgtSz+I= github.com/projectdiscovery/freeport v0.0.7 h1:Q6uXo/j8SaV/GlAHkEYQi8WQoPXyJWxyspx+aFmz9Qk= From 888bdd81e4b4a29d2e84fd914ee16a23834b0c81 Mon Sep 17 00:00:00 2001 From: Mzack9999 Date: Wed, 25 Mar 2026 17:46:57 +0100 Subject: [PATCH 06/32] remove random (unsupported curves pick) --- common/httpx/httpx.go | 6 ++-- common/httpx/tls_impersonate_test.go | 51 ++++------------------------ 2 files changed, 8 insertions(+), 49 deletions(-) diff --git a/common/httpx/httpx.go b/common/httpx/httpx.go index b6ac7f9d6..c4050da3e 100644 --- a/common/httpx/httpx.go +++ b/common/httpx/httpx.go @@ -230,14 +230,12 @@ func (h *HTTPX) buildTLSDialer(options *Options) func(ctx context.Context, netwo func resolveImpersonateStrategy(value string) (impersonate.Strategy, *impersonate.Identity) { switch strings.ToLower(value) { - case "", "random": - return impersonate.Random, nil - case "chrome": + case "", "chrome": return impersonate.Chrome, nil default: spec, err := ja3.ParseWithJa3(value) if err != nil { - return impersonate.Random, nil + return impersonate.Chrome, nil } identity := impersonate.Identity(*spec) return impersonate.Custom, &identity diff --git a/common/httpx/tls_impersonate_test.go b/common/httpx/tls_impersonate_test.go index b95467d68..773f7befc 100644 --- a/common/httpx/tls_impersonate_test.go +++ b/common/httpx/tls_impersonate_test.go @@ -107,21 +107,9 @@ func startTLSServer(t *testing.T) (string, func() *capturedHello) { // --- Unit tests for resolveImpersonateStrategy --- func TestResolveImpersonateStrategy(t *testing.T) { - t.Run("empty defaults to random", func(t *testing.T) { + t.Run("empty defaults to chrome", func(t *testing.T) { strategy, identity := resolveImpersonateStrategy("") - require.Equal(t, impersonate.Random, strategy) - require.Nil(t, identity) - }) - - t.Run("random", func(t *testing.T) { - strategy, identity := resolveImpersonateStrategy("random") - require.Equal(t, impersonate.Random, strategy) - require.Nil(t, identity) - }) - - t.Run("random case insensitive", func(t *testing.T) { - strategy, identity := resolveImpersonateStrategy("Random") - require.Equal(t, impersonate.Random, strategy) + require.Equal(t, impersonate.Chrome, strategy) require.Nil(t, identity) }) @@ -144,15 +132,15 @@ func TestResolveImpersonateStrategy(t *testing.T) { require.NotNil(t, identity) }) - t.Run("invalid ja3 falls back to random", func(t *testing.T) { + t.Run("invalid ja3 falls back to chrome", func(t *testing.T) { strategy, identity := resolveImpersonateStrategy("not-a-ja3-string") - require.Equal(t, impersonate.Random, strategy) + require.Equal(t, impersonate.Chrome, strategy) require.Nil(t, identity) }) - t.Run("partial ja3 falls back to random", func(t *testing.T) { + t.Run("partial ja3 falls back to chrome", func(t *testing.T) { strategy, identity := resolveImpersonateStrategy("771,4865") - require.Equal(t, impersonate.Random, strategy) + require.Equal(t, impersonate.Chrome, strategy) require.Nil(t, identity) }) } @@ -181,28 +169,6 @@ func TestTLSImpersonate_DefaultGoTLS(t *testing.T) { require.NotEmpty(t, hello.CipherSuites, "default Go TLS should have cipher suites") } -func TestTLSImpersonate_Random(t *testing.T) { - addr, getHello := startTLSServer(t) - - opts := fastdialer.DefaultOptions - opts.EnableFallback = false - fd, err := fastdialer.NewDialer(opts) - require.NoError(t, err) - defer fd.Close() - - conn, err := fd.DialTLSWithConfigImpersonate( - context.Background(), "tcp", addr, - &tls.Config{InsecureSkipVerify: true}, - impersonate.Random, nil, - ) - require.NoError(t, err) - _ = conn.Close() - - hello := getHello() - require.NotNil(t, hello) - require.NotEmpty(t, hello.CipherSuites, "random impersonation should have cipher suites") -} - func TestTLSImpersonate_Chrome(t *testing.T) { addr, getHello := startTLSServer(t) @@ -223,7 +189,6 @@ func TestTLSImpersonate_Chrome(t *testing.T) { hello := getHello() require.NotNil(t, hello) require.NotEmpty(t, hello.CipherSuites) - // Chrome 106 uses GREASE values (0xNANA pattern) as the first cipher suite hasGrease := false for _, cs := range hello.CipherSuites { if cs&0x0f0f == 0x0a0a { @@ -277,7 +242,6 @@ func TestTLSImpersonate_ChromeDiffersFromDefault(t *testing.T) { require.NoError(t, err) defer fd.Close() - // Default (no impersonation) conn, err := fd.DialTLSWithConfigImpersonate( context.Background(), "tcp", addr, &tls.Config{InsecureSkipVerify: true}, @@ -287,7 +251,6 @@ func TestTLSImpersonate_ChromeDiffersFromDefault(t *testing.T) { _ = conn.Close() defaultHello := getHello() - // Chrome conn, err = fd.DialTLSWithConfigImpersonate( context.Background(), "tcp", addr, &tls.Config{InsecureSkipVerify: true}, @@ -300,7 +263,6 @@ func TestTLSImpersonate_ChromeDiffersFromDefault(t *testing.T) { require.NotNil(t, defaultHello) require.NotNil(t, chromeHello) - // Chrome should have more cipher suites than Go's default (includes GREASE + broader set) require.NotEqual(t, defaultHello.CipherSuites, chromeHello.CipherSuites, "Chrome impersonation should produce different cipher suites than default Go TLS") } @@ -353,7 +315,6 @@ func TestTLSImpersonate_EndToEnd_HTTPX(t *testing.T) { wantErr bool }{ {"disabled", "", false}, - {"random", "random", false}, {"chrome", "chrome", false}, {"ja3", "771,49195-49196,0-23-65281-10-11-35-16-5-13-18,23-24,0", false}, } From 09917beda1ba42017b3ec33629f0ee515d667862 Mon Sep 17 00:00:00 2001 From: PDTeamX <8293321+ehsandeep@users.noreply.github.com> Date: Thu, 9 Jul 2026 23:24:35 +0700 Subject: [PATCH 07/32] docker CI fix --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 279594ac2..205b1353f 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,5 @@ # Base -FROM golang:1.25.7-alpine AS builder +FROM golang:1.26.5-alpine AS builder RUN apk add --no-cache git build-base gcc musl-dev WORKDIR /app From 6d2399a9f37a5fa3991ecaf1b5a31f7a6a3b9094 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 16 Jul 2026 11:43:32 +0400 Subject: [PATCH 08/32] chore(deps): bump the modules group across 1 directory with 5 updates (#2530) Bumps the modules group with 4 updates in the / directory: [github.com/projectdiscovery/cdncheck](https://github.com/projectdiscovery/cdncheck), [github.com/projectdiscovery/fastdialer](https://github.com/projectdiscovery/fastdialer), [github.com/projectdiscovery/retryablehttp-go](https://github.com/projectdiscovery/retryablehttp-go) and [github.com/projectdiscovery/wappalyzergo](https://github.com/projectdiscovery/wappalyzergo). Updates `github.com/projectdiscovery/cdncheck` from 1.2.42 to 1.2.44 - [Release notes](https://github.com/projectdiscovery/cdncheck/releases) - [Commits](https://github.com/projectdiscovery/cdncheck/compare/v1.2.42...v1.2.44) Updates `github.com/projectdiscovery/fastdialer` from 0.5.11 to 0.5.13 - [Release notes](https://github.com/projectdiscovery/fastdialer/releases) - [Commits](https://github.com/projectdiscovery/fastdialer/compare/v0.5.11...v0.5.13) Updates `github.com/projectdiscovery/networkpolicy` from 0.1.41 to 0.1.42 - [Release notes](https://github.com/projectdiscovery/networkpolicy/releases) - [Commits](https://github.com/projectdiscovery/networkpolicy/compare/v0.1.41...v0.1.42) Updates `github.com/projectdiscovery/retryablehttp-go` from 1.3.16 to 1.3.18 - [Release notes](https://github.com/projectdiscovery/retryablehttp-go/releases) - [Commits](https://github.com/projectdiscovery/retryablehttp-go/compare/v1.3.16...v1.3.18) Updates `github.com/projectdiscovery/wappalyzergo` from 0.2.87 to 0.2.89 - [Release notes](https://github.com/projectdiscovery/wappalyzergo/releases) - [Commits](https://github.com/projectdiscovery/wappalyzergo/compare/v0.2.87...v0.2.89) --- updated-dependencies: - dependency-name: github.com/projectdiscovery/cdncheck dependency-version: 1.2.43 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: modules - dependency-name: github.com/projectdiscovery/fastdialer dependency-version: 0.5.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: modules - dependency-name: github.com/projectdiscovery/networkpolicy dependency-version: 0.1.42 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: modules - dependency-name: github.com/projectdiscovery/retryablehttp-go dependency-version: 1.3.17 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: modules - dependency-name: github.com/projectdiscovery/wappalyzergo dependency-version: 0.2.88 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: modules ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 10 +++++----- go.sum | 20 ++++++++++---------- 2 files changed, 15 insertions(+), 15 deletions(-) diff --git a/go.mod b/go.mod index 538142bc6..75d7edaad 100644 --- a/go.mod +++ b/go.mod @@ -19,24 +19,24 @@ require ( github.com/miekg/dns v1.1.68 // indirect github.com/pkg/errors v0.9.1 github.com/projectdiscovery/asnmap v1.1.1 - github.com/projectdiscovery/cdncheck v1.2.42 + github.com/projectdiscovery/cdncheck v1.2.44 github.com/projectdiscovery/clistats v0.1.4 github.com/projectdiscovery/dsl v0.8.20 - github.com/projectdiscovery/fastdialer v0.5.11 + github.com/projectdiscovery/fastdialer v0.5.13 github.com/projectdiscovery/fdmax v0.0.4 github.com/projectdiscovery/goconfig v0.0.1 github.com/projectdiscovery/goflags v0.1.74 github.com/projectdiscovery/gologger v1.1.71 github.com/projectdiscovery/hmap v0.0.101 github.com/projectdiscovery/mapcidr v1.1.97 - github.com/projectdiscovery/networkpolicy v0.1.41 + github.com/projectdiscovery/networkpolicy v0.1.42 github.com/projectdiscovery/ratelimit v0.0.88 github.com/projectdiscovery/rawhttp v0.1.90 - github.com/projectdiscovery/retryablehttp-go v1.3.16 + github.com/projectdiscovery/retryablehttp-go v1.3.18 github.com/projectdiscovery/tlsx v1.2.2 github.com/projectdiscovery/useragent v0.0.108 github.com/projectdiscovery/utils v0.11.1 - github.com/projectdiscovery/wappalyzergo v0.2.87 + github.com/projectdiscovery/wappalyzergo v0.2.89 github.com/rs/xid v1.6.0 github.com/spaolacci/murmur3 v1.1.0 github.com/stretchr/testify v1.11.1 diff --git a/go.sum b/go.sum index 827d7e42c..c00f5a857 100644 --- a/go.sum +++ b/go.sum @@ -249,14 +249,14 @@ github.com/projectdiscovery/awesome-search-queries v0.0.0-20260104120501-961ef30 github.com/projectdiscovery/awesome-search-queries v0.0.0-20260104120501-961ef30f7193/go.mod h1:nSovPcipgSx/EzAefF+iCfORolkKAuodiRWL3RCGHOM= github.com/projectdiscovery/blackrock v0.0.1 h1:lHQqhaaEFjgf5WkuItbpeCZv2DUIE45k0VbGJyft6LQ= github.com/projectdiscovery/blackrock v0.0.1/go.mod h1:ANUtjDfaVrqB453bzToU+YB4cUbvBRpLvEwoWIwlTss= -github.com/projectdiscovery/cdncheck v1.2.42 h1:Y1Q9MPq7uuv25+aGlgjA5nToOcsk+9gNEKjicyhIwQI= -github.com/projectdiscovery/cdncheck v1.2.42/go.mod h1:9oE9KKxCSHNvUf0UaMeqqUwWpC38FkNaTll0ScIBT3w= +github.com/projectdiscovery/cdncheck v1.2.44 h1:5OXeIbHQ43d8lkgKAUyu5mWh/EneYDOl/5xmStgYRvo= +github.com/projectdiscovery/cdncheck v1.2.44/go.mod h1:9oE9KKxCSHNvUf0UaMeqqUwWpC38FkNaTll0ScIBT3w= github.com/projectdiscovery/clistats v0.1.4 h1:kDnXoNxIdOvQElOF7k2Mt6XosGa5GbMKPtRXdPHMVzU= github.com/projectdiscovery/clistats v0.1.4/go.mod h1:hjJYNcUubk9T3cuFvA+JkLhZGjzYW50fkC48dqUAtbU= github.com/projectdiscovery/dsl v0.8.20 h1:CxWcKuoHFpOSS1kzqnbJuK5No/6qoRG8IzNDMnZ6c/M= github.com/projectdiscovery/dsl v0.8.20/go.mod h1:e1oHi7mxAxF+UhBhD5gOk90Ga6LQqvFea2voMO1E5D0= -github.com/projectdiscovery/fastdialer v0.5.11 h1:eI7jfwz0i73Ot1cowIBezQLxbg0i6INdAsFGJjfwPa0= -github.com/projectdiscovery/fastdialer v0.5.11/go.mod h1:W1ZkULr9mMR6i0oRFTztANnpVyEEzPUovK8sUM4eAw8= +github.com/projectdiscovery/fastdialer v0.5.13 h1:Tocdk3yy7WKLmRV1YmWctPI2yU1QfJIlUbMarIzdgGg= +github.com/projectdiscovery/fastdialer v0.5.13/go.mod h1:iSf7DMOttk4LH/YSNAaztliqVCo1cVlmyudR+YXJWW8= github.com/projectdiscovery/fdmax v0.0.4 h1:K9tIl5MUZrEMzjvwn/G4drsHms2aufTn1xUdeVcmhmc= github.com/projectdiscovery/fdmax v0.0.4/go.mod h1:oZLqbhMuJ5FmcoaalOm31B1P4Vka/CqP50nWjgtSz+I= github.com/projectdiscovery/freeport v0.0.7 h1:Q6uXo/j8SaV/GlAHkEYQi8WQoPXyJWxyspx+aFmz9Qk= @@ -277,16 +277,16 @@ github.com/projectdiscovery/machineid v0.0.0-20250715113114-c77eb3567582 h1:eR+0 github.com/projectdiscovery/machineid v0.0.0-20250715113114-c77eb3567582/go.mod h1:3G3BRKui7nMuDFAZKR/M2hiOLtaOmyukT20g88qRQjI= github.com/projectdiscovery/mapcidr v1.1.97 h1:7FkxNNVXp+m1rIu5Nv/2SrF9k4+LwP8QuWs2puwy+2w= github.com/projectdiscovery/mapcidr v1.1.97/go.mod h1:9dgTJh1SP02gYZdpzMjm6vtYFkEHQHoTyaVNvaeJ7lA= -github.com/projectdiscovery/networkpolicy v0.1.41 h1:6daf4A8Vj1+iQ7nH2FR4+sOYd7q1WH1qfN61EyQU74c= -github.com/projectdiscovery/networkpolicy v0.1.41/go.mod h1:9ULLaMbdv9UnT0C5rmuK4nIwYs0o776xMnkPUb8TtaE= +github.com/projectdiscovery/networkpolicy v0.1.42 h1:/d5vriH8fDMoEaFCSD1nuCWs/ki3dft+CDqQnYrKyLg= +github.com/projectdiscovery/networkpolicy v0.1.42/go.mod h1:9ULLaMbdv9UnT0C5rmuK4nIwYs0o776xMnkPUb8TtaE= github.com/projectdiscovery/ratelimit v0.0.88 h1:AcurW9aLRzlEyPe9kSjnOpr3XzLMWTpiWAlW/w73ALU= github.com/projectdiscovery/ratelimit v0.0.88/go.mod h1:CU1s+68UUG2mctSl2wi32/DHLJA6TMg+4rxgP59LfVk= github.com/projectdiscovery/rawhttp v0.1.90 h1:LOSZ6PUH08tnKmWsIwvwv1Z/4zkiYKYOSZ6n+8RFKtw= github.com/projectdiscovery/rawhttp v0.1.90/go.mod h1:VZYAM25UI/wVB3URZ95ZaftgOnsbphxyAw/XnQRRz4Y= github.com/projectdiscovery/retryabledns v1.0.115 h1:RKV63FNIznFHUoawg/1hs53pVH3wqPtFhwstCuxVSoA= github.com/projectdiscovery/retryabledns v1.0.115/go.mod h1:+fEMWoPigw+M0lGNKY7AZ+g8FIgj+4sONjsinMmeL3k= -github.com/projectdiscovery/retryablehttp-go v1.3.16 h1:M/xICwSaiSHhd5OIarU3+5JoU7VmbiSAAwYUCK7CTjw= -github.com/projectdiscovery/retryablehttp-go v1.3.16/go.mod h1:s0azLAqAbcVCjHI9t0ezPhamevYGM1eoOvFkn4QmpZ8= +github.com/projectdiscovery/retryablehttp-go v1.3.18 h1:7dQwd/z3Yq0WOixI62qgT4v3YxT2OWqxkkLQz3lXsjE= +github.com/projectdiscovery/retryablehttp-go v1.3.18/go.mod h1:35LyqKrpCM68qDL5nle4Xu4hnY2LJ0n7Q9DEmPMP7A4= github.com/projectdiscovery/stringsutil v0.0.2 h1:uzmw3IVLJSMW1kEg8eCStG/cGbYYZAja8BH3LqqJXMA= github.com/projectdiscovery/stringsutil v0.0.2/go.mod h1:EJ3w6bC5fBYjVou6ryzodQq37D5c6qbAYQpGmAy+DC0= github.com/projectdiscovery/tlsx v1.2.2 h1:Y96QBqeD2anpzEtBl4kqNbwzXh2TrzJuXfgiBLvK+SE= @@ -295,8 +295,8 @@ github.com/projectdiscovery/useragent v0.0.108 h1:fb+uLuFJvC+MHZjCtxQJxtvp1X6A8n github.com/projectdiscovery/useragent v0.0.108/go.mod h1:XdNRrlvtDmYfVL1Oybat4uMe+W6cLwsK9S18ond17CI= github.com/projectdiscovery/utils v0.11.1 h1:PWj1KjIASxt8icxommH72C0TQqNOvGkcSODRkiq0SQw= github.com/projectdiscovery/utils v0.11.1/go.mod h1:yktGrHGk2CTjNiccXovnvGrLHX9sV2bqz9nSnbA3V8M= -github.com/projectdiscovery/wappalyzergo v0.2.87 h1:KuUpeRSQ80L6tx9YaAPhfYWTF47bpEURYbAymr76zto= -github.com/projectdiscovery/wappalyzergo v0.2.87/go.mod h1:gMH0o5lBp65sKMwHx/tuUdOtW2RjodC6Ti+9QDsYMkY= +github.com/projectdiscovery/wappalyzergo v0.2.89 h1:z4TMGcX2iq1+wF94srp5F/TzyUL18Od/l0B+b7PBfqM= +github.com/projectdiscovery/wappalyzergo v0.2.89/go.mod h1:gMH0o5lBp65sKMwHx/tuUdOtW2RjodC6Ti+9QDsYMkY= github.com/refraction-networking/utls v1.8.2 h1:j4Q1gJj0xngdeH+Ox/qND11aEfhpgoEvV+S9iJ2IdQo= github.com/refraction-networking/utls v1.8.2/go.mod h1:jkSOEkLqn+S/jtpEHPOsVv/4V4EVnelwbMQl4vCWXAM= github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= From b85cb8674d9e382ee37fa10878526d6e421ce08c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 16 Jul 2026 11:43:36 +0400 Subject: [PATCH 09/32] chore(deps): bump github.com/happyhackingspace/dit from 0.0.28 to 0.0.29 (#2531) Bumps [github.com/happyhackingspace/dit](https://github.com/happyhackingspace/dit) from 0.0.28 to 0.0.29. - [Release notes](https://github.com/happyhackingspace/dit/releases) - [Commits](https://github.com/happyhackingspace/dit/compare/v0.0.28...v0.0.29) --- updated-dependencies: - dependency-name: github.com/happyhackingspace/dit dependency-version: 0.0.29 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 75d7edaad..0ef9f1c8f 100644 --- a/go.mod +++ b/go.mod @@ -54,7 +54,7 @@ require ( github.com/go-sql-driver/mysql v1.10.0 github.com/go-viper/mapstructure/v2 v2.5.0 github.com/gocarina/gocsv v0.0.0-20240520201108-78e41c74b4b1 - github.com/happyhackingspace/dit v0.0.28 + github.com/happyhackingspace/dit v0.0.29 github.com/lib/pq v1.12.3 github.com/projectdiscovery/awesome-search-queries v0.0.0-20260104120501-961ef30f7193 github.com/seh-msft/burpxml v1.0.1 diff --git a/go.sum b/go.sum index c00f5a857..1c6b8a1af 100644 --- a/go.sum +++ b/go.sum @@ -148,8 +148,8 @@ github.com/gosimple/slug v1.15.0 h1:wRZHsRrRcs6b0XnxMUBM6WK1U1Vg5B0R7VkIf1Xzobo= github.com/gosimple/slug v1.15.0/go.mod h1:UiRaFH+GEilHstLUmcBgWcI42viBN7mAb818JrYOeFQ= github.com/gosimple/unidecode v1.0.1 h1:hZzFTMMqSswvf0LBJZCZgThIZrpDHFXux9KeGmn6T/o= github.com/gosimple/unidecode v1.0.1/go.mod h1:CP0Cr1Y1kogOtx0bJblKzsVWrqYaqfNOnHzpgWw4Awc= -github.com/happyhackingspace/dit v0.0.28 h1:iuX6NjGGEiPNXXltmCrj+LObSKxAy4pwKIEImfMm6pc= -github.com/happyhackingspace/dit v0.0.28/go.mod h1:TFhaJk9bARUpwcycEUwtLK8ZRC0XKInXivg3j/QmNcY= +github.com/happyhackingspace/dit v0.0.29 h1:QISPnGsVvRGmJlAmfJisKdx1Dtd6/Fh6L4j1eMpBWBU= +github.com/happyhackingspace/dit v0.0.29/go.mod h1:TFhaJk9bARUpwcycEUwtLK8ZRC0XKInXivg3j/QmNcY= github.com/hashicorp/go-version v1.8.0 h1:KAkNb1HAiZd1ukkxDFGmokVZe1Xy9HG6NUp+bPle2i4= github.com/hashicorp/go-version v1.8.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA= github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k= From 4988f48fd7a3636fc1a9f5653a182d57e9d8d554 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 16 Jul 2026 11:43:39 +0400 Subject: [PATCH 10/32] chore(deps): bump golang.org/x/text from 0.38.0 to 0.40.0 (#2534) Bumps [golang.org/x/text](https://github.com/golang/text) from 0.38.0 to 0.40.0. - [Release notes](https://github.com/golang/text/releases) - [Commits](https://github.com/golang/text/compare/v0.38.0...v0.40.0) --- updated-dependencies: - dependency-name: golang.org/x/text dependency-version: 0.40.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 8 ++++---- go.sum | 16 ++++++++-------- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/go.mod b/go.mod index 0ef9f1c8f..ed21e6cec 100644 --- a/go.mod +++ b/go.mod @@ -46,7 +46,7 @@ require ( golang.org/x/exp v0.0.0-20250911091902-df9299821621 golang.org/x/net v0.56.0 golang.org/x/sys v0.46.0 // indirect - golang.org/x/text v0.38.0 + golang.org/x/text v0.40.0 ) require ( @@ -162,11 +162,11 @@ require ( github.com/zcalusic/sysinfo v1.0.2 // indirect github.com/zmap/rc2 v0.0.0-20190804163417-abaa70531248 // indirect golang.org/x/crypto v0.53.0 // indirect - golang.org/x/mod v0.36.0 // indirect + golang.org/x/mod v0.37.0 // indirect golang.org/x/oauth2 v0.34.0 // indirect - golang.org/x/sync v0.21.0 // indirect + golang.org/x/sync v0.22.0 // indirect golang.org/x/term v0.44.0 // indirect golang.org/x/time v0.14.0 // indirect - golang.org/x/tools v0.45.0 // indirect + golang.org/x/tools v0.47.0 // indirect gopkg.in/ini.v1 v1.67.0 // indirect ) diff --git a/go.sum b/go.sum index 1c6b8a1af..b9b367dae 100644 --- a/go.sum +++ b/go.sum @@ -444,8 +444,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c= golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c= -golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4= -golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ= +golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ= +golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0= golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= @@ -478,8 +478,8 @@ golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y= golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= -golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM= -golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= +golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek= +golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= @@ -538,8 +538,8 @@ golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI= golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ= -golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE= -golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4= +golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs= +golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY= golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI= golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= @@ -548,8 +548,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58= golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk= -golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8= -golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0= +golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q= +golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM= From e18c703e974e063e421ba6a26fa73af0be33ef9f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 16 Jul 2026 11:45:00 +0400 Subject: [PATCH 11/32] chore(deps): bump golang.org/x/net from 0.56.0 to 0.57.0 (#2535) Bumps [golang.org/x/net](https://github.com/golang/net) from 0.56.0 to 0.57.0. - [Commits](https://github.com/golang/net/compare/v0.56.0...v0.57.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-version: 0.57.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Mzack9999 --- go.mod | 8 ++++---- go.sum | 16 ++++++++-------- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/go.mod b/go.mod index ed21e6cec..d130b0d8b 100644 --- a/go.mod +++ b/go.mod @@ -44,8 +44,8 @@ require ( go.etcd.io/bbolt v1.4.0 // indirect go.uber.org/multierr v1.11.0 golang.org/x/exp v0.0.0-20250911091902-df9299821621 - golang.org/x/net v0.56.0 - golang.org/x/sys v0.46.0 // indirect + golang.org/x/net v0.57.0 + golang.org/x/sys v0.47.0 // indirect golang.org/x/text v0.40.0 ) @@ -161,11 +161,11 @@ require ( github.com/yusufpapurcu/wmi v1.2.4 // indirect github.com/zcalusic/sysinfo v1.0.2 // indirect github.com/zmap/rc2 v0.0.0-20190804163417-abaa70531248 // indirect - golang.org/x/crypto v0.53.0 // indirect + golang.org/x/crypto v0.54.0 // indirect golang.org/x/mod v0.37.0 // indirect golang.org/x/oauth2 v0.34.0 // indirect golang.org/x/sync v0.22.0 // indirect - golang.org/x/term v0.44.0 // indirect + golang.org/x/term v0.45.0 // indirect golang.org/x/time v0.14.0 // indirect golang.org/x/tools v0.47.0 // indirect gopkg.in/ini.v1 v1.67.0 // indirect diff --git a/go.sum b/go.sum index b9b367dae..9b84c4e8d 100644 --- a/go.sum +++ b/go.sum @@ -435,8 +435,8 @@ golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDf golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8= golang.org/x/crypto v0.25.0/go.mod h1:T+wALwcMOSE0kXgUAnPAHqTLW+XHgcELELW8VaDgm/M= golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk= -golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto= -golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio= +golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw= +golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk= golang.org/x/exp v0.0.0-20250911091902-df9299821621 h1:2id6c1/gto0kaHYyrixvknJ8tUK/Qs5IsmBtrc+FtgU= golang.org/x/exp v0.0.0-20250911091902-df9299821621/go.mod h1:TwQYMMnGpvZyc+JpB/UAuTNIsVJifOlSkrZkhcvpVUk= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= @@ -464,8 +464,8 @@ golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44= golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM= golang.org/x/net v0.27.0/go.mod h1:dDi0PyhWNoiUOrAS8uXv/vnScO4wnHQO4mj9fn/RytE= golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4= -golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o= -golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec= +golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= +golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.6.0/go.mod h1:ycmewcwgD4Rpr3eZJLSB4Kyyljb3qDh40vJ8STE5HKw= golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw= @@ -507,8 +507,8 @@ golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.22.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= -golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw= -golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= +golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE= golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= @@ -521,8 +521,8 @@ golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk= golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY= golang.org/x/term v0.22.0/go.mod h1:F3qCibpT5AMpCRfhfT53vVJwhLtIVHhB9XDjfFvnMI4= golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM= -golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc= -golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y= +golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0= +golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= From 997f3f5241e95b613904d2393e4b1ead34c14dad Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E2=99=BE=EF=B8=8F?= <82095453+iacker@users.noreply.github.com> Date: Thu, 16 Jul 2026 10:51:45 +0200 Subject: [PATCH 12/32] docs: add Common Recipes section for well-known files (#2527) * docs: add Common Recipes section for well-known files Per maintainer feedback on PR #2472, add a 'Common Recipes' section demonstrating how to detect security.txt, robots.txt, sitemap.xml, and other well-known URIs using httpx's composable primitives. Includes: - security.txt detection with RFC 9116 compliance checks - robots.txt and sitemap.xml probes - IANA well-known URIs registry reference - One-liner examples using -path, -mc, -mct, -mr flags Reference: https://github.com/projectdiscovery/httpx/issues/2468#issuecomment-4298328468 * extend recipes * fix errcheck * review fixes * pure tests --------- Co-authored-by: Dogan Can Bakir <65292895+dogancanbakir@users.noreply.github.com> Co-authored-by: Mzack9999 --- README.md | 75 +++++++++++++++ runner/wellknown_recipes.go | 152 +++++++++++++++++++++++++++++++ runner/wellknown_recipes_test.go | 123 +++++++++++++++++++++++++ 3 files changed, 350 insertions(+) create mode 100644 runner/wellknown_recipes.go create mode 100644 runner/wellknown_recipes_test.go diff --git a/README.md b/README.md index e41811d17..e6dc724de 100644 --- a/README.md +++ b/README.md @@ -285,6 +285,81 @@ For details about running httpx, see https://docs.projectdiscovery.io/tools/http ### Using `httpx` as a library `httpx` can be used as a library by creating an instance of the `Option` struct and populating it with the same options that would be specified via CLI. Once validated, the struct should be passed to a runner instance (to be closed at the end of the program) and the `RunEnumeration` method should be called. A minimal example of how to do it is in the [examples](examples/) folder. +## Common Recipes + +Below are practical one-liners for common use cases leveraging httpx's composable primitives. These recipes are validated in `runner/wellknown_recipes_test.go`. + +Use `-mdc` with DSL helpers such as `contains(content_type, ...)` and `contains(body, ...)` to match response metadata and body content. (`-mr`/`-ms` match the full raw response; use `-mdc` for structured field matching.) + +### Well-known files + +**security.txt** +Probe for a valid [RFC 9116](https://www.rfc-editor.org/rfc/rfc9116.html) security.txt file at the standard paths (`/.well-known/security.txt`, `/security.txt`): + +```bash +echo target.com | httpx -path '/.well-known/security.txt,/security.txt' -mc 200 -mdc 'contains(content_type, "text/plain") && contains(body, "Contact:") && contains_any(body, "mailto:", "https://")' +``` + +- `-path` tests custom path(s) +- `-mc 200` matches HTTP 200 +- `-mdc` matches using DSL expressions on response fields such as `content_type` and `body` + +**robots.txt** + +```bash +echo target.com | httpx -path '/robots.txt' -mc 200 -mdc 'contains(content_type, "text/plain")' +``` + +**sitemap.xml** + +```bash +echo target.com | httpx -path '/sitemap.xml' -mc 200 -mdc 'contains_any(content_type, "application/xml", "text/xml") && contains(body, "`, + }, + "/humans.txt": { + statusCode: 200, + contentType: "text/plain", + body: "/* TEAM */\nDeveloper: Example Dev\n", + }, + "/ads.txt": { + statusCode: 200, + contentType: "text/plain", + body: "google.com, pub-0000000000000000, DIRECT, f08c47fec0942fa0\n", + }, + "/.well-known/openid-configuration": { + statusCode: 200, + contentType: "application/json", + body: `{"issuer":"https://example.com","authorization_endpoint":"https://example.com/auth"}`, + }, + "/.well-known/apple-app-site-association": { + statusCode: 200, + contentType: "application/json", + body: `{"applinks":{"apps":[],"details":[]}}`, + }, + "/.well-known/apple-app-site-association.json": { + statusCode: 200, + contentType: "application/json", + body: `{"applinks":{"apps":[],"details":[]}}`, + }, + "/.well-known/assetlinks.json": { + statusCode: 200, + contentType: "application/json", + body: `[{"relation":["delegate_permission/common.handle_all_urls"],"target":{"namespace":"android_app","package_name":"com.example.app"}}]`, + }, + "/crossdomain.xml": { + statusCode: 200, + contentType: "text/xml", + body: ``, + }, + "/.well-known/change-password": { + statusCode: 200, + contentType: "text/html", + body: "Change password", + }, +} + +// soft404Fixture is an HTML error page that should not match strict well-known recipes. +var soft404Fixture = wellKnownFixture{ + statusCode: 200, + contentType: "text/html; charset=utf-8", + body: "Not Found

404

", +} diff --git a/runner/wellknown_recipes_test.go b/runner/wellknown_recipes_test.go new file mode 100644 index 000000000..327e29103 --- /dev/null +++ b/runner/wellknown_recipes_test.go @@ -0,0 +1,123 @@ +package runner + +import ( + "net/http" + "net/http/httptest" + "strings" + "testing" + + "github.com/projectdiscovery/httpx/common/stringz" + sliceutil "github.com/projectdiscovery/utils/slice" + "github.com/stretchr/testify/require" +) + +func TestWellKnownRecipes(t *testing.T) { + for _, recipe := range WellKnownRecipes() { + t.Run(recipe.Name, func(t *testing.T) { + matched := false + for path, fixture := range wellKnownFixtures { + if !recipeMatchesPath(recipe, path) { + continue + } + result := resultFromWellKnownFixture(path, fixture) + if recipeMatches(recipe, result) { + matched = true + break + } + } + require.True(t, matched, "recipe %q should match at least one fixture", recipe.Name) + }) + } +} + +func TestWellKnownRecipeSecurityTxtRejectsSoft404(t *testing.T) { + recipe := WellKnownRecipes()[0] + result := resultFromWellKnownFixture("/.well-known/security.txt", soft404Fixture) + require.False(t, recipeMatches(recipe, result), "security.txt recipe should not match HTML soft-404 pages") +} + +func TestWellKnownRecipeSecurityTxtRejectsMissingContact(t *testing.T) { + recipe := WellKnownRecipes()[0] + result := resultFromWellKnownFixture("/.well-known/security.txt", wellKnownFixture{ + statusCode: http.StatusOK, + contentType: "text/plain", + body: "Preferred-Languages: en\n", + }) + require.False(t, recipeMatches(recipe, result), "security.txt recipe should require a Contact field") +} + +func TestWellKnownRecipeAdsTxtRejectsInvalidBody(t *testing.T) { + recipe := WellKnownRecipes()[4] + result := resultFromWellKnownFixture("/ads.txt", wellKnownFixture{ + statusCode: http.StatusOK, + contentType: "text/plain", + body: "example.com, DIRECT\n", + }) + require.False(t, recipeMatches(recipe, result), "ads.txt recipe should require an authorized digital seller entry") +} + +func TestWellKnownRecipesHTTPProbe(t *testing.T) { + ts := newWellKnownTestServer(t) + defer ts.Close() + + recipe := WellKnownRecipes()[len(WellKnownRecipes())-1] + for _, path := range strings.Split(recipe.Paths, ",") { + t.Run(path, func(t *testing.T) { + resp, err := http.Get(ts.URL + path) + require.NoError(t, err) + defer func() { _ = resp.Body.Close() }() + require.Equal(t, http.StatusOK, resp.StatusCode) + }) + } +} + +func recipeMatchesPath(recipe WellKnownRecipe, path string) bool { + for _, recipePath := range strings.Split(recipe.Paths, ",") { + if recipePath == path { + return true + } + } + return false +} + +func recipeMatches(recipe WellKnownRecipe, result Result) bool { + if recipe.MatchStatusCode != "" { + codes, err := stringz.StringToSliceInt(recipe.MatchStatusCode) + if err != nil || !sliceutil.Contains(codes, result.StatusCode) { + return false + } + } + if recipe.MatchCondition != "" && !evalDslExpr(result, recipe.MatchCondition) { + return false + } + return true +} + +func resultFromWellKnownFixture(path string, fixture wellKnownFixture) Result { + url := "http://example.com" + path + contentType := fixture.contentType + if idx := strings.Index(contentType, ";"); idx >= 0 { + contentType = strings.TrimSpace(contentType[:idx]) + } + return Result{ + StatusCode: fixture.statusCode, + ContentType: contentType, + ResponseBody: fixture.body, + URL: url, + str: url, + } +} + +func newWellKnownTestServer(t *testing.T) *httptest.Server { + t.Helper() + return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + fixture, ok := wellKnownFixtures[r.URL.Path] + if !ok { + http.NotFound(w, r) + return + } + w.Header().Set("Content-Type", fixture.contentType) + w.WriteHeader(fixture.statusCode) + _, _ = w.Write([]byte(fixture.body)) + })) +} From a053579d7e6038945459c81a3c2cbf33b2bd874d Mon Sep 17 00:00:00 2001 From: Mzack9999 Date: Thu, 16 Jul 2026 12:52:12 +0400 Subject: [PATCH 13/32] Populate CPE version when ASQ product names differ from wappalyzer (#2538) * fix cpe * fix suffixes --- runner/cpe.go | 89 +++++++++++++++++++++- runner/cpe_test.go | 184 ++++++++++++++++++++++++++++++++++++++++++++- 2 files changed, 271 insertions(+), 2 deletions(-) diff --git a/runner/cpe.go b/runner/cpe.go index 6861dea86..5d7c91f08 100644 --- a/runner/cpe.go +++ b/runner/cpe.go @@ -3,6 +3,7 @@ package runner import ( "encoding/json" "fmt" + "slices" "strings" awesomesearchqueries "github.com/projectdiscovery/awesome-search-queries" @@ -160,6 +161,92 @@ func normalizeProductName(name string) string { return b.String() } +// cpeProductSuffixes are common awesome-search-queries product suffixes stripped +// to derive shorter lookup aliases (e.g. liferay_portal -> liferay). +var cpeProductSuffixes = []string{ + "_server", + "_portal", + "_software", + "_platform", + "_suite", + "_service", + "_manager", + "_panel", + "_cms", + "_firmware", + "_gateway", + "_proxy", + "_system", + "_application", + "_framework", + "_tower", + "_policy_manager", +} + +// productLookupKeys returns normalized lookup keys for joining a CPE product +// name to wappalyzer technology names. Keys are ordered most-specific first; +// the first key with a version match wins. +func productLookupKeys(product string) []string { + product = strings.TrimSpace(product) + if product == "" { + return nil + } + + // Compound awesome-search-queries names list multiple products; the first is + // the primary identifier for version lookup purposes. + if idx := strings.Index(product, ","); idx >= 0 { + product = strings.TrimSpace(product[:idx]) + } + + seen := make(map[string]struct{}) + keys := make([]string, 0, 4) + addKey := func(raw string) { + key := normalizeProductName(raw) + if key == "" { + return + } + if _, ok := seen[key]; ok { + return + } + seen[key] = struct{}{} + keys = append(keys, key) + } + + addKey(product) + + lower := strings.ToLower(product) + suffixes := slices.Clone(cpeProductSuffixes) + slices.SortFunc(suffixes, func(a, b string) int { + return len(b) - len(a) + }) + for _, suffix := range suffixes { + if strings.HasSuffix(lower, suffix) { + addKey(strings.TrimSuffix(lower, suffix)) + } + } + + if strings.Contains(lower, "_") { + parts := strings.Split(lower, "_") + addKey(parts[0]) + for i := 2; i <= len(parts); i++ { + addKey(strings.Join(parts[:i], "_")) + } + } + + return keys +} + +// lookupTechVersion finds a wappalyzer version for a CPE product using exact +// and alias keys derived from awesome-search-queries naming conventions. +func lookupTechVersion(product string, versions map[string]string) (string, bool) { + for _, key := range productLookupKeys(product) { + if version, ok := versions[key]; ok { + return version, true + } + } + return "", false +} + // buildTechVersionMap maps normalized technology name -> version, parsing // wappalyzer's "Name:version" entries (FormatAppVersion convention). Entries // without a version are skipped. A product reported with conflicting versions @@ -203,7 +290,7 @@ func EnrichCPEVersions(matches []CPEInfo, technologies []string) []CPEInfo { enriched := make([]CPEInfo, len(matches)) for i, match := range matches { enriched[i] = match - if version, ok := versions[normalizeProductName(match.Product)]; ok { + if version, ok := lookupTechVersion(match.Product, versions); ok { enriched[i].CPE = setCPEVersion(match.CPE, version) } } diff --git a/runner/cpe_test.go b/runner/cpe_test.go index fe163bf0c..168fc2019 100644 --- a/runner/cpe_test.go +++ b/runner/cpe_test.go @@ -159,6 +159,187 @@ func TestBuildTechVersionMap(t *testing.T) { } } +func TestProductLookupKeys(t *testing.T) { + t.Parallel() + + tests := []struct { + name string + in string + want []string + }{ + { + name: "liferay portal strips suffix", + in: "liferay_portal", + want: []string{"liferayportal", "liferay"}, + }, + { + name: "confluence server strips suffix", + in: "confluence_server", + want: []string{"confluenceserver", "confluence"}, + }, + { + name: "tableau server strips suffix", + in: "tableau_server", + want: []string{"tableauserver", "tableau"}, + }, + { + name: "longest suffix takes priority", + in: "ansible_policy_manager", + want: []string{"ansiblepolicymanager", "ansible", "ansiblepolicy"}, + }, + { + name: "compound name uses primary product", + in: "digital_experience_platform,liferay_portal", + want: []string{"digitalexperienceplatform", "digitalexperience", "digital"}, + }, + { + name: "display name unchanged", + in: "Apache HTTP Server", + want: []string{"apachehttpserver"}, + }, + { + name: "simple product", + in: "next.js", + want: []string{"nextjs"}, + }, + { + name: "empty", + in: "", + want: nil, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + got := productLookupKeys(tt.in) + if len(got) != len(tt.want) { + t.Fatalf("productLookupKeys(%q) = %v, want %v", tt.in, got, tt.want) + } + for i := range tt.want { + if got[i] != tt.want[i] { + t.Fatalf("productLookupKeys(%q)[%d] = %q, want %q (full: %v)", tt.in, i, got[i], tt.want[i], got) + } + } + }) + } +} + +func TestLookupTechVersion(t *testing.T) { + t.Parallel() + + versions := buildTechVersionMap([]string{ + "Liferay:7.3.5", + "Confluence:8.5.1", + "Tableau:2023.1", + "Apache HTTP Server:2.4.7", + "Ansible:2.14.0", + }) + + tests := []struct { + product string + want string + wantFound bool + }{ + {"liferay_portal", "7.3.5", true}, + {"liferay", "7.3.5", true}, + {"confluence_server", "8.5.1", true}, + {"tableau_server", "2023.1", true}, + {"ansible_policy_manager", "2.14.0", true}, + {"Apache HTTP Server", "2.4.7", true}, + {"phpcollab", "", false}, + {"unknown_product", "", false}, + } + for _, tt := range tests { + t.Run(tt.product, func(t *testing.T) { + got, ok := lookupTechVersion(tt.product, versions) + if ok != tt.wantFound { + t.Fatalf("lookupTechVersion(%q) found = %v, want %v", tt.product, ok, tt.wantFound) + } + if got != tt.want { + t.Fatalf("lookupTechVersion(%q) = %q, want %q", tt.product, got, tt.want) + } + }) + } +} + +func TestEnrichCPEVersionsIssue2536(t *testing.T) { + t.Parallel() + + tests := []struct { + name string + product string + vendor string + cpe string + technologies []string + wantCPE string + }{ + { + name: "liferay portal product name from awesome-search-queries", + product: "liferay_portal", + vendor: "liferay", + cpe: "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*", + technologies: []string{"Liferay:7.3.5"}, + wantCPE: "cpe:2.3:a:liferay:liferay_portal:7.3.5:*:*:*:*:*:*:*", + }, + { + name: "confluence server product name", + product: "confluence_server", + vendor: "atlassian", + cpe: "cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*", + technologies: []string{"Confluence:8.5.1"}, + wantCPE: "cpe:2.3:a:atlassian:confluence_server:8.5.1:*:*:*:*:*:*:*", + }, + { + name: "tableau server product name", + product: "tableau_server", + vendor: "tableau", + cpe: "cpe:2.3:a:tableau:tableau_server:*:*:*:*:*:*:*:*", + technologies: []string{"Tableau:2023.1"}, + wantCPE: "cpe:2.3:a:tableau:tableau_server:2023.1:*:*:*:*:*:*:*", + }, + { + name: "no false match on unrelated substring", + product: "phpcollab", + vendor: "phpcollab", + cpe: "cpe:2.3:a:phpcollab:phpcollab:*:*:*:*:*:*:*:*", + technologies: []string{"PHP:8.1.0"}, + wantCPE: "cpe:2.3:a:phpcollab:phpcollab:*:*:*:*:*:*:*:*", + }, + { + name: "ansible tower strips suffix", + product: "ansible_tower", + vendor: "redhat", + cpe: "cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*", + technologies: []string{"Ansible:2.14.0"}, + wantCPE: "cpe:2.3:a:redhat:ansible_tower:2.14.0:*:*:*:*:*:*:*", + }, + { + name: "ansible policy manager prefers ansible alias", + product: "ansible_policy_manager", + vendor: "redhat", + cpe: "cpe:2.3:a:redhat:ansible_policy_manager:*:*:*:*:*:*:*:*", + technologies: []string{"Ansible:2.14.0"}, + wantCPE: "cpe:2.3:a:redhat:ansible_policy_manager:2.14.0:*:*:*:*:*:*:*", + }, + { + name: "conflicting tech versions leave cpe unchanged", + product: "liferay_portal", + vendor: "liferay", + cpe: "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*", + technologies: []string{"Liferay:7.3.5", "Liferay:7.4.0"}, + wantCPE: "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*", + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + matches := []CPEInfo{{Product: tt.product, Vendor: tt.vendor, CPE: tt.cpe}} + got := EnrichCPEVersions(matches, tt.technologies) + if got[0].CPE != tt.wantCPE { + t.Fatalf("CPE = %q, want %q", got[0].CPE, tt.wantCPE) + } + }) + } +} + func TestBuildTechVersionMapConflict(t *testing.T) { // the same product reported with two versions must be dropped, not resolved // by random map iteration order. @@ -233,8 +414,9 @@ func TestEnrichCPEVersionsWithRealWappalyzer(t *testing.T) { t.Fatalf("expected wappalyzer to emit \"Liferay:7.3.5\", got %v", technologies) } + // awesome-search-queries uses snake_case product names; issue #2536. matches := []CPEInfo{ - {Product: "Liferay", Vendor: "liferay", CPE: "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*"}, + {Product: "liferay_portal", Vendor: "liferay", CPE: "cpe:2.3:a:liferay:liferay_portal:*:*:*:*:*:*:*:*"}, } got := EnrichCPEVersions(matches, technologies) if got[0].CPE != "cpe:2.3:a:liferay:liferay_portal:7.3.5:*:*:*:*:*:*:*" { From 569a7517b060cb8b91545ed90e29cca1cefc0e4b Mon Sep 17 00:00:00 2001 From: Mzack9999 Date: Thu, 16 Jul 2026 13:01:15 +0400 Subject: [PATCH 14/32] fix domains --- common/httpx/domains.go | 78 ++++++++++++++++++++++++++++++------ common/httpx/domains_test.go | 54 +++++++++++++++++++++++++ 2 files changed, 119 insertions(+), 13 deletions(-) diff --git a/common/httpx/domains.go b/common/httpx/domains.go index 76da3b700..572906cec 100644 --- a/common/httpx/domains.go +++ b/common/httpx/domains.go @@ -2,6 +2,7 @@ package httpx import ( "bytes" + "net" "net/url" "regexp" "strings" @@ -38,30 +39,80 @@ func (h *HTTPX) BodyDomainGrab(r *Response) *BodyDomain { domains := make(map[string]struct{}) fqdns := make(map[string]struct{}) - // Only run HTML/JS parsers if the body looks like HTML - if len(r.Data) > 0 && looksLikeHTML(r.Data) { - inlineScripts := extractDomainsFromHTML(r.Data, domains, fqdns, r.Input) - - for _, script := range inlineScripts { - if len(script) <= maxInlineScriptSize { - extractDomainsFromJS(script, domains, fqdns, r.Input) + if len(r.Data) > 0 { + switch { + case looksLikeHTML(r.Data): + inlineScripts := extractDomainsFromHTML(r.Data, domains, fqdns, r.Input) + for _, script := range inlineScripts { + if len(script) <= maxInlineScriptSize { + extractDomainsFromJS(script, domains, fqdns, r.Input) + } + } + case looksLikeJavaScript(r.Data, r.GetHeader("Content-Type")): + if len(r.Data) <= maxInlineScriptSize { + extractDomainsFromJS(string(r.Data), domains, fqdns, r.Input) + } else { + extractDomainsFromRegex(string(r.Data), domains, fqdns, r.Input) } + default: + extractDomainsFromRegex(r.Raw, domains, fqdns, r.Input) } + } else { + extractDomainsFromRegex(r.Raw, domains, fqdns, r.Input) } - // Regex fallback on the raw response (catches anything the parsers miss) - extractDomainsFromRegex(r.Raw, domains, fqdns, r.Input) - return &BodyDomain{Domains: mapsutil.GetKeys(domains), Fqdns: mapsutil.GetKeys(fqdns)} } func looksLikeHTML(data []byte) bool { + trimmed := trimmedBodyPrefix(data) + return len(trimmed) > 0 && trimmed[0] == '<' +} + +func looksLikeJavaScript(data []byte, contentType string) bool { + ct := strings.ToLower(contentType) + if strings.Contains(ct, "javascript") || strings.Contains(ct, "ecmascript") { + return true + } + + trimmed := trimmedBodyPrefix(data) + if len(trimmed) == 0 { + return false + } + + s := string(trimmed) + return strings.HasPrefix(s, "var ") || + strings.HasPrefix(s, "const ") || + strings.HasPrefix(s, "let ") || + strings.HasPrefix(s, "function") || + strings.HasPrefix(s, "(function") || + strings.HasPrefix(s, "/*") || + strings.HasPrefix(s, "//") || + strings.HasPrefix(s, "import ") || + strings.HasPrefix(s, "export ") || + strings.HasPrefix(s, "!") || + strings.HasPrefix(s, "\"use strict\"") || + strings.HasPrefix(s, "'use strict'") +} + +func trimmedBodyPrefix(data []byte) []byte { prefix := data if len(prefix) > 1024 { prefix = prefix[:1024] } trimmed := bytes.TrimSpace(prefix) - return len(trimmed) > 0 && trimmed[0] == '<' + return bytes.TrimPrefix(trimmed, []byte{0xEF, 0xBB, 0xBF}) +} + +func inputHostname(input string) string { + input = strings.ToLower(strings.TrimSpace(input)) + if input == "" { + return "" + } + if host, _, err := net.SplitHostPort(input); err == nil { + return host + } + return input } // extractDomainsFromHTML parses HTML and extracts hostnames from URL-bearing @@ -191,10 +242,11 @@ func addDomainCandidate(d string, domains, fqdns map[string]struct{}, input stri if err != nil { return } - if input != val { + inputHost := inputHostname(input) + if inputHost != val { domains[val] = struct{}{} } - if d != val && d != input { + if d != val && d != inputHost { fqdns[d] = struct{}{} } } diff --git a/common/httpx/domains_test.go b/common/httpx/domains_test.go index de35937d4..9c53837f1 100644 --- a/common/httpx/domains_test.go +++ b/common/httpx/domains_test.go @@ -133,6 +133,27 @@ func TestBodyDomainGrabNonHTML(t *testing.T) { require.Contains(t, bd.Fqdns, "api.plain.example.com") } +func TestBodyDomainGrabJavaScriptBody(t *testing.T) { + ht, err := New(&DefaultOptions) + require.Nil(t, err) + + script := "const api = `https://js-only.example.com/v1`;" + response := &Response{ + Raw: script, + Data: []byte(script), + Headers: map[string][]string{ + "Content-Type": {"application/javascript"}, + }, + } + bd := ht.BodyDomainGrab(response) + + require.Contains(t, bd.Fqdns, "js-only.example.com") +} + +func TestLooksLikeHTML_UTF8BOM(t *testing.T) { + require.True(t, looksLikeHTML([]byte("\xef\xbb\xbf"))) +} + func TestBodyDomainGrabBrokenJS(t *testing.T) { ht, err := New(&DefaultOptions) require.Nil(t, err) @@ -467,6 +488,31 @@ func TestEdgeCase_InputDomainExclusion(t *testing.T) { require.Contains(t, bd.Fqdns, "other.different.net") } +func TestEdgeCase_InputDomainExclusionWithPort(t *testing.T) { + ht, err := New(&DefaultOptions) + require.Nil(t, err) + + html := ` + self + other + ` + response := &Response{ + Raw: html, + Data: []byte(html), + Input: "example.com:8080", + } + bd := ht.BodyDomainGrab(response) + + for _, d := range bd.Domains { + require.NotEqual(t, "example.com", d, "input host should be excluded from domains") + } + for _, f := range bd.Fqdns { + require.NotEqual(t, "example.com", f, "input host should be excluded from fqdns") + } + require.Contains(t, bd.Domains, "different.net") + require.Contains(t, bd.Fqdns, "other.different.net") +} + func TestEdgeCase_EmptyAndWhitespaceScripts(t *testing.T) { ht, err := New(&DefaultOptions) require.Nil(t, err) @@ -969,6 +1015,14 @@ func TestAddDomainCandidate(t *testing.T) { require.Empty(t, fqdns) }) + t.Run("input host with port excluded from domains", func(t *testing.T) { + domains := make(map[string]struct{}) + fqdns := make(map[string]struct{}) + addDomainCandidate("sub.example.com", domains, fqdns, "example.com:443") + require.Empty(t, domains) + require.Contains(t, fqdns, "sub.example.com") + }) + t.Run("empty string rejected", func(t *testing.T) { domains := make(map[string]struct{}) fqdns := make(map[string]struct{}) From 3f465fe796681ce8573da46db8c9ac04d7ce99e6 Mon Sep 17 00:00:00 2001 From: Mzack9999 Date: Thu, 16 Jul 2026 14:22:01 +0400 Subject: [PATCH 15/32] warn ja3 --- common/httpx/httpx.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/common/httpx/httpx.go b/common/httpx/httpx.go index fc2ab6203..b7133828d 100644 --- a/common/httpx/httpx.go +++ b/common/httpx/httpx.go @@ -20,6 +20,7 @@ import ( "github.com/projectdiscovery/fastdialer/fastdialer" "github.com/projectdiscovery/fastdialer/fastdialer/ja3" "github.com/projectdiscovery/fastdialer/fastdialer/ja3/impersonate" + "github.com/projectdiscovery/gologger" "github.com/projectdiscovery/httpx/common/httputilz" "github.com/projectdiscovery/networkpolicy" "github.com/projectdiscovery/rawhttp" @@ -234,7 +235,7 @@ func (h *HTTPX) buildTLSDialer(options *Options) func(ctx context.Context, netwo func resolveImpersonateStrategy(value string) (impersonate.Strategy, *impersonate.Identity) { switch strings.ToLower(value) { - case "chrome": + case "", "chrome": return impersonate.Chrome, nil case "random": // random JA3 mode was removed due to unsupported curve picks; keep chrome for compatibility. @@ -242,6 +243,7 @@ func resolveImpersonateStrategy(value string) (impersonate.Strategy, *impersonat default: spec, err := ja3.ParseWithJa3(value) if err != nil { + gologger.Warning().Msgf("invalid tls-impersonate value %q: %v; falling back to chrome", value, err) return impersonate.Chrome, nil } identity := impersonate.Identity(*spec) From 53beddb15b25dba4076b4d77f17a52a5fb0a2fbd Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 20 Jul 2026 10:11:55 +0000 Subject: [PATCH 16/32] chore(deps): bump the modules group with 3 updates Bumps the modules group with 3 updates: [github.com/projectdiscovery/cdncheck](https://github.com/projectdiscovery/cdncheck), [github.com/projectdiscovery/retryablehttp-go](https://github.com/projectdiscovery/retryablehttp-go) and [github.com/projectdiscovery/wappalyzergo](https://github.com/projectdiscovery/wappalyzergo). Updates `github.com/projectdiscovery/cdncheck` from 1.2.44 to 1.2.45 - [Release notes](https://github.com/projectdiscovery/cdncheck/releases) - [Commits](https://github.com/projectdiscovery/cdncheck/compare/v1.2.44...v1.2.45) Updates `github.com/projectdiscovery/retryablehttp-go` from 1.3.18 to 1.3.19 - [Release notes](https://github.com/projectdiscovery/retryablehttp-go/releases) - [Commits](https://github.com/projectdiscovery/retryablehttp-go/compare/v1.3.18...v1.3.19) Updates `github.com/projectdiscovery/wappalyzergo` from 0.2.89 to 0.2.90 - [Release notes](https://github.com/projectdiscovery/wappalyzergo/releases) - [Commits](https://github.com/projectdiscovery/wappalyzergo/compare/v0.2.89...v0.2.90) --- updated-dependencies: - dependency-name: github.com/projectdiscovery/cdncheck dependency-version: 1.2.45 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: modules - dependency-name: github.com/projectdiscovery/retryablehttp-go dependency-version: 1.3.19 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: modules - dependency-name: github.com/projectdiscovery/wappalyzergo dependency-version: 0.2.90 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: modules ... Signed-off-by: dependabot[bot] --- go.mod | 6 +++--- go.sum | 12 ++++++------ 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/go.mod b/go.mod index 18d04dc35..9153ff33c 100644 --- a/go.mod +++ b/go.mod @@ -19,7 +19,7 @@ require ( github.com/miekg/dns v1.1.68 // indirect github.com/pkg/errors v0.9.1 github.com/projectdiscovery/asnmap v1.1.1 - github.com/projectdiscovery/cdncheck v1.2.44 + github.com/projectdiscovery/cdncheck v1.2.45 github.com/projectdiscovery/clistats v0.1.4 github.com/projectdiscovery/dsl v0.8.20 github.com/projectdiscovery/fastdialer v0.5.13 @@ -32,11 +32,11 @@ require ( github.com/projectdiscovery/networkpolicy v0.1.42 github.com/projectdiscovery/ratelimit v0.0.88 github.com/projectdiscovery/rawhttp v0.1.90 - github.com/projectdiscovery/retryablehttp-go v1.3.18 + github.com/projectdiscovery/retryablehttp-go v1.3.19 github.com/projectdiscovery/tlsx v1.2.2 github.com/projectdiscovery/useragent v0.0.108 github.com/projectdiscovery/utils v0.11.1 - github.com/projectdiscovery/wappalyzergo v0.2.89 + github.com/projectdiscovery/wappalyzergo v0.2.90 github.com/rs/xid v1.6.0 github.com/spaolacci/murmur3 v1.1.0 github.com/stretchr/testify v1.11.1 diff --git a/go.sum b/go.sum index 4c1afc114..96ca67cfc 100644 --- a/go.sum +++ b/go.sum @@ -253,8 +253,8 @@ github.com/projectdiscovery/awesome-search-queries v0.0.0-20260104120501-961ef30 github.com/projectdiscovery/awesome-search-queries v0.0.0-20260104120501-961ef30f7193/go.mod h1:nSovPcipgSx/EzAefF+iCfORolkKAuodiRWL3RCGHOM= github.com/projectdiscovery/blackrock v0.0.1 h1:lHQqhaaEFjgf5WkuItbpeCZv2DUIE45k0VbGJyft6LQ= github.com/projectdiscovery/blackrock v0.0.1/go.mod h1:ANUtjDfaVrqB453bzToU+YB4cUbvBRpLvEwoWIwlTss= -github.com/projectdiscovery/cdncheck v1.2.44 h1:5OXeIbHQ43d8lkgKAUyu5mWh/EneYDOl/5xmStgYRvo= -github.com/projectdiscovery/cdncheck v1.2.44/go.mod h1:9oE9KKxCSHNvUf0UaMeqqUwWpC38FkNaTll0ScIBT3w= +github.com/projectdiscovery/cdncheck v1.2.45 h1:OUInJ7JrbCTikb5vIax1Z4d31O1hlnnxGaaZ9FOyIKQ= +github.com/projectdiscovery/cdncheck v1.2.45/go.mod h1:9oE9KKxCSHNvUf0UaMeqqUwWpC38FkNaTll0ScIBT3w= github.com/projectdiscovery/clistats v0.1.4 h1:kDnXoNxIdOvQElOF7k2Mt6XosGa5GbMKPtRXdPHMVzU= github.com/projectdiscovery/clistats v0.1.4/go.mod h1:hjJYNcUubk9T3cuFvA+JkLhZGjzYW50fkC48dqUAtbU= github.com/projectdiscovery/dsl v0.8.20 h1:CxWcKuoHFpOSS1kzqnbJuK5No/6qoRG8IzNDMnZ6c/M= @@ -289,8 +289,8 @@ github.com/projectdiscovery/rawhttp v0.1.90 h1:LOSZ6PUH08tnKmWsIwvwv1Z/4zkiYKYOS github.com/projectdiscovery/rawhttp v0.1.90/go.mod h1:VZYAM25UI/wVB3URZ95ZaftgOnsbphxyAw/XnQRRz4Y= github.com/projectdiscovery/retryabledns v1.0.115 h1:RKV63FNIznFHUoawg/1hs53pVH3wqPtFhwstCuxVSoA= github.com/projectdiscovery/retryabledns v1.0.115/go.mod h1:+fEMWoPigw+M0lGNKY7AZ+g8FIgj+4sONjsinMmeL3k= -github.com/projectdiscovery/retryablehttp-go v1.3.18 h1:7dQwd/z3Yq0WOixI62qgT4v3YxT2OWqxkkLQz3lXsjE= -github.com/projectdiscovery/retryablehttp-go v1.3.18/go.mod h1:35LyqKrpCM68qDL5nle4Xu4hnY2LJ0n7Q9DEmPMP7A4= +github.com/projectdiscovery/retryablehttp-go v1.3.19 h1:WUmMV+sD4BZBT9aOCNZXtXM1maBlMLkPQSi4xiy8mhg= +github.com/projectdiscovery/retryablehttp-go v1.3.19/go.mod h1:Cdd/nTPQe5PiCyFjrJaxWZJmLnKomAnLvR+WOC8J6Xw= github.com/projectdiscovery/stringsutil v0.0.2 h1:uzmw3IVLJSMW1kEg8eCStG/cGbYYZAja8BH3LqqJXMA= github.com/projectdiscovery/stringsutil v0.0.2/go.mod h1:EJ3w6bC5fBYjVou6ryzodQq37D5c6qbAYQpGmAy+DC0= github.com/projectdiscovery/tlsx v1.2.2 h1:Y96QBqeD2anpzEtBl4kqNbwzXh2TrzJuXfgiBLvK+SE= @@ -299,8 +299,8 @@ github.com/projectdiscovery/useragent v0.0.108 h1:fb+uLuFJvC+MHZjCtxQJxtvp1X6A8n github.com/projectdiscovery/useragent v0.0.108/go.mod h1:XdNRrlvtDmYfVL1Oybat4uMe+W6cLwsK9S18ond17CI= github.com/projectdiscovery/utils v0.11.1 h1:PWj1KjIASxt8icxommH72C0TQqNOvGkcSODRkiq0SQw= github.com/projectdiscovery/utils v0.11.1/go.mod h1:yktGrHGk2CTjNiccXovnvGrLHX9sV2bqz9nSnbA3V8M= -github.com/projectdiscovery/wappalyzergo v0.2.89 h1:z4TMGcX2iq1+wF94srp5F/TzyUL18Od/l0B+b7PBfqM= -github.com/projectdiscovery/wappalyzergo v0.2.89/go.mod h1:gMH0o5lBp65sKMwHx/tuUdOtW2RjodC6Ti+9QDsYMkY= +github.com/projectdiscovery/wappalyzergo v0.2.90 h1:fuzStSlVB5RHmbKz5CScvEbxRnBoIyYCn7oh1xQRuvo= +github.com/projectdiscovery/wappalyzergo v0.2.90/go.mod h1:gMH0o5lBp65sKMwHx/tuUdOtW2RjodC6Ti+9QDsYMkY= github.com/refraction-networking/utls v1.8.2 h1:j4Q1gJj0xngdeH+Ox/qND11aEfhpgoEvV+S9iJ2IdQo= github.com/refraction-networking/utls v1.8.2/go.mod h1:jkSOEkLqn+S/jtpEHPOsVv/4V4EVnelwbMQl4vCWXAM= github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= From 70f8b0048c4cea1003d0c3c27979838667149c0b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 20 Jul 2026 10:12:00 +0000 Subject: [PATCH 17/32] chore(deps): bump github.com/go-faker/faker/v4 from 4.9.0 to 4.10.0 Bumps [github.com/go-faker/faker/v4](https://github.com/go-faker/faker) from 4.9.0 to 4.10.0. - [Release notes](https://github.com/go-faker/faker/releases) - [Commits](https://github.com/go-faker/faker/compare/v4.9.0...v4.10.0) --- updated-dependencies: - dependency-name: github.com/go-faker/faker/v4 dependency-version: 4.10.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- go.mod | 4 ++-- go.sum | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/go.mod b/go.mod index 18d04dc35..b5c19b72c 100644 --- a/go.mod +++ b/go.mod @@ -1,13 +1,13 @@ module github.com/projectdiscovery/httpx -go 1.26 +go 1.26.0 require ( github.com/Mzack9999/gcache v0.0.0-20230410081825-519e28eab057 github.com/PuerkitoBio/goquery v1.12.0 github.com/akrylysov/pogreb v0.10.2 // indirect github.com/corona10/goimagehash v1.1.0 - github.com/go-faker/faker/v4 v4.9.0 + github.com/go-faker/faker/v4 v4.10.0 github.com/go-rod/rod v0.116.2 github.com/golang/snappy v0.0.4 // indirect github.com/hbakhtiyor/strsim v0.0.0-20190107154042-4d2bbb273edf diff --git a/go.sum b/go.sum index 4c1afc114..4a89b7da0 100644 --- a/go.sum +++ b/go.sum @@ -98,8 +98,8 @@ github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4 github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw= github.com/gaissmai/bart v0.28.0 h1:89yZLo8NmyqD0RYgJ3QO9HhqqGGw+oWhf90cZm69Lko= github.com/gaissmai/bart v0.28.0/go.mod h1:GREWQfTLRWz/c5FTOsIw+KkscuFkIV5t8Rp7Nd1Td5c= -github.com/go-faker/faker/v4 v4.9.0 h1:a4HXLwueuTCtgF93VpUsl8Zd2nG1VH2SgNWDPVEBg5U= -github.com/go-faker/faker/v4 v4.9.0/go.mod h1:u1dIRP5neLB6kTzgyVjdBOV5R1uP7BdxkcWk7tiKQXk= +github.com/go-faker/faker/v4 v4.10.0 h1:rHTZVwG1x8aN4zXDYJUFucOGDQojuxOby5MTdC/M2Fw= +github.com/go-faker/faker/v4 v4.10.0/go.mod h1:X+KzPB4JZ82GY4MYr7NV7zmp+i/K0SG5EDKqIg5zd1k= github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY= github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0= github.com/go-rod/rod v0.116.2 h1:A5t2Ky2A+5eD/ZJQr1EfsQSe5rms5Xof/qj296e+ZqA= From ef56b829f48c463e044b4fb3344bd8256a8faf4f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 20 Jul 2026 10:12:03 +0000 Subject: [PATCH 18/32] chore(deps): bump github.com/happyhackingspace/dit from 0.0.29 to 0.0.31 Bumps [github.com/happyhackingspace/dit](https://github.com/happyhackingspace/dit) from 0.0.29 to 0.0.31. - [Release notes](https://github.com/happyhackingspace/dit/releases) - [Commits](https://github.com/happyhackingspace/dit/compare/v0.0.29...v0.0.31) --- updated-dependencies: - dependency-name: github.com/happyhackingspace/dit dependency-version: 0.0.31 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- go.mod | 12 ++++++------ go.sum | 23 ++++++++++++----------- 2 files changed, 18 insertions(+), 17 deletions(-) diff --git a/go.mod b/go.mod index 18d04dc35..4f802051a 100644 --- a/go.mod +++ b/go.mod @@ -55,7 +55,7 @@ require ( github.com/go-sql-driver/mysql v1.10.0 github.com/go-viper/mapstructure/v2 v2.5.0 github.com/gocarina/gocsv v0.0.0-20240520201108-78e41c74b4b1 - github.com/happyhackingspace/dit v0.0.29 + github.com/happyhackingspace/dit v0.0.31 github.com/lib/pq v1.12.3 github.com/projectdiscovery/awesome-search-queries v0.0.0-20260104120501-961ef30f7193 github.com/seh-msft/burpxml v1.0.1 @@ -67,7 +67,7 @@ require ( require ( aead.dev/minisign v0.2.0 // indirect filippo.io/edwards25519 v1.2.0 // indirect - github.com/Masterminds/semver/v3 v3.4.0 // indirect + github.com/Masterminds/semver/v3 v3.5.0 // indirect github.com/Mzack9999/go-http-digest-auth-client v0.6.1-0.20220414142836-eb8883508809 // indirect github.com/VividCortex/ewma v1.2.0 // indirect github.com/alecthomas/chroma/v2 v2.14.0 // indirect @@ -97,14 +97,14 @@ require ( github.com/go-sourcemap/sourcemap v2.1.3+incompatible // indirect github.com/google/certificate-transparency-go v1.3.2 // indirect github.com/google/go-github/v30 v30.1.0 // indirect - github.com/google/go-querystring v1.1.0 // indirect + github.com/google/go-querystring v1.2.0 // indirect github.com/google/pprof v0.0.0-20240227163752-401108e1b7e7 // indirect github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect github.com/google/uuid v1.6.0 // indirect github.com/gorilla/css v1.0.1 // indirect github.com/gosimple/slug v1.15.0 // indirect github.com/gosimple/unidecode v1.0.1 // indirect - github.com/hashicorp/go-version v1.8.0 // indirect + github.com/hashicorp/go-version v1.9.0 // indirect github.com/iangcarroll/cookiemonster v1.6.0 // indirect github.com/json-iterator/go v1.1.12 // indirect github.com/kataras/jwt v0.1.10 // indirect @@ -165,10 +165,10 @@ require ( github.com/zmap/rc2 v0.0.0-20190804163417-abaa70531248 // indirect golang.org/x/crypto v0.54.0 // indirect golang.org/x/mod v0.37.0 // indirect - golang.org/x/oauth2 v0.34.0 // indirect + golang.org/x/oauth2 v0.36.0 // indirect golang.org/x/sync v0.22.0 // indirect golang.org/x/term v0.45.0 // indirect - golang.org/x/time v0.14.0 // indirect + golang.org/x/time v0.15.0 // indirect golang.org/x/tools v0.47.0 // indirect gopkg.in/ini.v1 v1.67.0 // indirect ) diff --git a/go.sum b/go.sum index 4c1afc114..4b9ef6190 100644 --- a/go.sum +++ b/go.sum @@ -3,8 +3,8 @@ aead.dev/minisign v0.2.0/go.mod h1:zdq6LdSd9TbuSxchxwhpA9zEb9YXcVGoE8JakuiGaIQ= cloud.google.com/go/compute/metadata v0.2.0/go.mod h1:zFmK7XCadkQkj6TtorcaGlCW1hT1fIilQDwofLpJ20k= filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo= filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc= -github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0= -github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM= +github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE= +github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM= github.com/Mzack9999/gcache v0.0.0-20230410081825-519e28eab057 h1:KFac3SiGbId8ub47e7kd2PLZeACxc1LkiiNoDOFRClE= github.com/Mzack9999/gcache v0.0.0-20230410081825-519e28eab057/go.mod h1:iLB2pivrPICvLOuROKmlqURtFIEsoJZaMidQfCG1+D4= github.com/Mzack9999/go-http-digest-auth-client v0.6.1-0.20220414142836-eb8883508809 h1:ZbFL+BDfBqegi+/Ssh7im5+aQfBRx6it+kHnC7jaDU8= @@ -137,8 +137,9 @@ github.com/google/go-github/v30 v30.1.0 h1:VLDx+UolQICEOKu2m4uAoMti1SxuEBAl7RSEG github.com/google/go-github/v30 v30.1.0/go.mod h1:n8jBpHl45a/rlBUtRJMOG4GhNADUQFEufcolZ95JfU8= github.com/google/go-github/v50 v50.2.0/go.mod h1:VBY8FB6yPIjrtKhozXv4FQupxKLS6H4m6xFZlT43q8Q= github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck= -github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8= github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU= +github.com/google/go-querystring v1.2.0 h1:yhqkPbu2/OH+V9BfpCVPZkNmUXhb2gBxJArfhIxNtP0= +github.com/google/go-querystring v1.2.0/go.mod h1:8IFJqpSRITyJ8QhQ13bmbeMBDfmeEJZD5A0egEOmkqU= github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= github.com/google/pprof v0.0.0-20240227163752-401108e1b7e7 h1:y3N7Bm7Y9/CtpiVkw/ZWj6lSlDF3F74SfKwfTCer72Q= github.com/google/pprof v0.0.0-20240227163752-401108e1b7e7/go.mod h1:czg5+yv1E0ZGTi6S6vVK1mke0fV+FaUhNGcd6VRS9Ik= @@ -152,10 +153,10 @@ github.com/gosimple/slug v1.15.0 h1:wRZHsRrRcs6b0XnxMUBM6WK1U1Vg5B0R7VkIf1Xzobo= github.com/gosimple/slug v1.15.0/go.mod h1:UiRaFH+GEilHstLUmcBgWcI42viBN7mAb818JrYOeFQ= github.com/gosimple/unidecode v1.0.1 h1:hZzFTMMqSswvf0LBJZCZgThIZrpDHFXux9KeGmn6T/o= github.com/gosimple/unidecode v1.0.1/go.mod h1:CP0Cr1Y1kogOtx0bJblKzsVWrqYaqfNOnHzpgWw4Awc= -github.com/happyhackingspace/dit v0.0.29 h1:QISPnGsVvRGmJlAmfJisKdx1Dtd6/Fh6L4j1eMpBWBU= -github.com/happyhackingspace/dit v0.0.29/go.mod h1:TFhaJk9bARUpwcycEUwtLK8ZRC0XKInXivg3j/QmNcY= -github.com/hashicorp/go-version v1.8.0 h1:KAkNb1HAiZd1ukkxDFGmokVZe1Xy9HG6NUp+bPle2i4= -github.com/hashicorp/go-version v1.8.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA= +github.com/happyhackingspace/dit v0.0.31 h1:E9HGMpWMEDRH+SvKPAGjTiKDZIZ4x6uHrn/PkwkGRv4= +github.com/happyhackingspace/dit v0.0.31/go.mod h1:xrqwz6vKxSDPQ9I1uOcK/mNEBFoZ1xY4ok3BRBhq+Sw= +github.com/hashicorp/go-version v1.9.0 h1:CeOIz6k+LoN3qX9Z0tyQrPtiB1DFYRPfCIBtaXPSCnA= +github.com/hashicorp/go-version v1.9.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA= github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k= github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM= github.com/hbakhtiyor/strsim v0.0.0-20190107154042-4d2bbb273edf h1:umfGUaWdFP2s6457fz1+xXYIWDxdGc7HdkLS9aJ1skk= @@ -472,8 +473,8 @@ golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.6.0/go.mod h1:ycmewcwgD4Rpr3eZJLSB4Kyyljb3qDh40vJ8STE5HKw= -golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw= -golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA= +golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= +golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -544,8 +545,8 @@ golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI= golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ= golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs= golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY= -golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI= -golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4= +golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= +golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= From a5012dad9ebc0570c362810fa6e09267e2fea83d Mon Sep 17 00:00:00 2001 From: Mzack9999 Date: Wed, 22 Jul 2026 15:28:38 +0400 Subject: [PATCH 19/32] group external --- .github/dependabot.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 120bb02ca..6a54bcc30 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -18,8 +18,13 @@ updates: labels: - "Type: Maintenance" groups: - modules: + # Internal PD libraries — usually safe to review as a batch + projectdiscovery: patterns: ["github.com/projectdiscovery/*"] + # Everything else (faker, dit, etc.) — separate from PD bumps + external: + patterns: ["*"] + exclude-patterns: ["github.com/projectdiscovery/*"] # # Maintain dependencies for GitHub Actions # - package-ecosystem: "github-actions" From 389ec19eb73dcf32341e10a088182908e0ef065f Mon Sep 17 00:00:00 2001 From: Mzack9999 Date: Wed, 22 Jul 2026 15:32:45 +0400 Subject: [PATCH 20/32] fix comments --- .github/dependabot.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 6a54bcc30..5de7c598f 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -18,10 +18,10 @@ updates: labels: - "Type: Maintenance" groups: - # Internal PD libraries — usually safe to review as a batch + # Internal PD libraries, usually safe to review as a batch projectdiscovery: patterns: ["github.com/projectdiscovery/*"] - # Everything else (faker, dit, etc.) — separate from PD bumps + # Other packages, separate from PD bumps external: patterns: ["*"] exclude-patterns: ["github.com/projectdiscovery/*"] From 892a6e6b5cb6ad3eb94cc7d092b3ba6bf4343f9c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 29 Jul 2026 10:13:07 +0000 Subject: [PATCH 21/32] chore(deps): bump the projectdiscovery group with 6 updates Bumps the projectdiscovery group with 6 updates: | Package | From | To | | --- | --- | --- | | [github.com/projectdiscovery/cdncheck](https://github.com/projectdiscovery/cdncheck) | `1.2.45` | `1.2.46` | | [github.com/projectdiscovery/goflags](https://github.com/projectdiscovery/goflags) | `0.1.74` | `0.1.75` | | [github.com/projectdiscovery/networkpolicy](https://github.com/projectdiscovery/networkpolicy) | `0.1.42` | `0.1.43` | | [github.com/projectdiscovery/rawhttp](https://github.com/projectdiscovery/rawhttp) | `0.1.90` | `0.1.91` | | [github.com/projectdiscovery/retryablehttp-go](https://github.com/projectdiscovery/retryablehttp-go) | `1.3.19` | `1.3.20` | | [github.com/projectdiscovery/wappalyzergo](https://github.com/projectdiscovery/wappalyzergo) | `0.2.90` | `0.2.91` | Updates `github.com/projectdiscovery/cdncheck` from 1.2.45 to 1.2.46 - [Release notes](https://github.com/projectdiscovery/cdncheck/releases) - [Commits](https://github.com/projectdiscovery/cdncheck/compare/v1.2.45...v1.2.46) Updates `github.com/projectdiscovery/goflags` from 0.1.74 to 0.1.75 - [Release notes](https://github.com/projectdiscovery/goflags/releases) - [Commits](https://github.com/projectdiscovery/goflags/compare/v0.1.74...v0.1.75) Updates `github.com/projectdiscovery/networkpolicy` from 0.1.42 to 0.1.43 - [Release notes](https://github.com/projectdiscovery/networkpolicy/releases) - [Commits](https://github.com/projectdiscovery/networkpolicy/compare/v0.1.42...v0.1.43) Updates `github.com/projectdiscovery/rawhttp` from 0.1.90 to 0.1.91 - [Release notes](https://github.com/projectdiscovery/rawhttp/releases) - [Commits](https://github.com/projectdiscovery/rawhttp/compare/v0.1.90...v0.1.91) Updates `github.com/projectdiscovery/retryablehttp-go` from 1.3.19 to 1.3.20 - [Release notes](https://github.com/projectdiscovery/retryablehttp-go/releases) - [Commits](https://github.com/projectdiscovery/retryablehttp-go/compare/v1.3.19...v1.3.20) Updates `github.com/projectdiscovery/wappalyzergo` from 0.2.90 to 0.2.91 - [Release notes](https://github.com/projectdiscovery/wappalyzergo/releases) - [Commits](https://github.com/projectdiscovery/wappalyzergo/compare/v0.2.90...v0.2.91) --- updated-dependencies: - dependency-name: github.com/projectdiscovery/cdncheck dependency-version: 1.2.46 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: projectdiscovery - dependency-name: github.com/projectdiscovery/goflags dependency-version: 0.1.75 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: projectdiscovery - dependency-name: github.com/projectdiscovery/networkpolicy dependency-version: 0.1.43 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: projectdiscovery - dependency-name: github.com/projectdiscovery/rawhttp dependency-version: 0.1.91 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: projectdiscovery - dependency-name: github.com/projectdiscovery/retryablehttp-go dependency-version: 1.3.20 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: projectdiscovery - dependency-name: github.com/projectdiscovery/wappalyzergo dependency-version: 0.2.91 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: projectdiscovery ... Signed-off-by: dependabot[bot] --- go.mod | 18 +++++++++--------- go.sum | 36 ++++++++++++++++++------------------ 2 files changed, 27 insertions(+), 27 deletions(-) diff --git a/go.mod b/go.mod index 43fc3129a..df46a3bd2 100644 --- a/go.mod +++ b/go.mod @@ -16,34 +16,34 @@ require ( github.com/logrusorgru/aurora v2.0.3+incompatible github.com/mfonda/simhash v0.0.0-20151007195837-79f94a1100d6 github.com/microcosm-cc/bluemonday v1.0.27 - github.com/miekg/dns v1.1.68 // indirect + github.com/miekg/dns v1.1.72 // indirect github.com/pkg/errors v0.9.1 github.com/projectdiscovery/asnmap v1.1.1 - github.com/projectdiscovery/cdncheck v1.2.45 + github.com/projectdiscovery/cdncheck v1.2.46 github.com/projectdiscovery/clistats v0.1.4 github.com/projectdiscovery/dsl v0.8.20 github.com/projectdiscovery/fastdialer v0.5.13 github.com/projectdiscovery/fdmax v0.0.4 github.com/projectdiscovery/goconfig v0.0.1 - github.com/projectdiscovery/goflags v0.1.74 + github.com/projectdiscovery/goflags v0.1.75 github.com/projectdiscovery/gologger v1.1.71 github.com/projectdiscovery/hmap v0.0.101 github.com/projectdiscovery/mapcidr v1.1.97 - github.com/projectdiscovery/networkpolicy v0.1.42 + github.com/projectdiscovery/networkpolicy v0.1.43 github.com/projectdiscovery/ratelimit v0.0.88 - github.com/projectdiscovery/rawhttp v0.1.90 - github.com/projectdiscovery/retryablehttp-go v1.3.19 + github.com/projectdiscovery/rawhttp v0.1.91 + github.com/projectdiscovery/retryablehttp-go v1.3.20 github.com/projectdiscovery/tlsx v1.2.2 github.com/projectdiscovery/useragent v0.0.108 github.com/projectdiscovery/utils v0.11.1 - github.com/projectdiscovery/wappalyzergo v0.2.90 + github.com/projectdiscovery/wappalyzergo v0.2.91 github.com/rs/xid v1.6.0 github.com/spaolacci/murmur3 v1.1.0 github.com/stretchr/testify v1.11.1 github.com/zmap/zcrypto v0.0.0-20240803002437-3a861682ac77 go.etcd.io/bbolt v1.4.0 // indirect go.uber.org/multierr v1.11.0 - golang.org/x/exp v0.0.0-20250911091902-df9299821621 + golang.org/x/exp v0.0.0-20260112195511-716be5621a96 golang.org/x/net v0.57.0 golang.org/x/sys v0.47.0 // indirect golang.org/x/text v0.40.0 @@ -92,7 +92,7 @@ require ( github.com/ebitengine/purego v0.10.0 // indirect github.com/fatih/color v1.18.0 // indirect github.com/felixge/fgprof v0.9.5 // indirect - github.com/gaissmai/bart v0.28.0 // indirect + github.com/gaissmai/bart v0.28.1 // indirect github.com/go-ole/go-ole v1.2.6 // indirect github.com/go-sourcemap/sourcemap v2.1.3+incompatible // indirect github.com/google/certificate-transparency-go v1.3.2 // indirect diff --git a/go.sum b/go.sum index 249b09bd6..02bfcd411 100644 --- a/go.sum +++ b/go.sum @@ -96,8 +96,8 @@ github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7z github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo= github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY= github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw= -github.com/gaissmai/bart v0.28.0 h1:89yZLo8NmyqD0RYgJ3QO9HhqqGGw+oWhf90cZm69Lko= -github.com/gaissmai/bart v0.28.0/go.mod h1:GREWQfTLRWz/c5FTOsIw+KkscuFkIV5t8Rp7Nd1Td5c= +github.com/gaissmai/bart v0.28.1 h1:1YhWqAcQaFklvhRd8x0FHA9qUCmArfqEwaORVkV2s6k= +github.com/gaissmai/bart v0.28.1/go.mod h1:GREWQfTLRWz/c5FTOsIw+KkscuFkIV5t8Rp7Nd1Td5c= github.com/go-faker/faker/v4 v4.10.0 h1:rHTZVwG1x8aN4zXDYJUFucOGDQojuxOby5MTdC/M2Fw= github.com/go-faker/faker/v4 v4.10.0/go.mod h1:X+KzPB4JZ82GY4MYr7NV7zmp+i/K0SG5EDKqIg5zd1k= github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY= @@ -211,8 +211,8 @@ github.com/mfonda/simhash v0.0.0-20151007195837-79f94a1100d6 h1:bjfMeqxWEJ6IRUvG github.com/mfonda/simhash v0.0.0-20151007195837-79f94a1100d6/go.mod h1:WVJJvUw/pIOcwu2O8ZzHEhmigq2jzwRNfJVRMJB7bR8= github.com/microcosm-cc/bluemonday v1.0.27 h1:MpEUotklkwCSLeH+Qdx1VJgNqLlpY2KXwXFM08ygZfk= github.com/microcosm-cc/bluemonday v1.0.27/go.mod h1:jFi9vgW+H7c3V0lb6nR74Ib/DIB5OBs92Dimizgw2cA= -github.com/miekg/dns v1.1.68 h1:jsSRkNozw7G/mnmXULynzMNIsgY2dHC8LO6U6Ij2JEA= -github.com/miekg/dns v1.1.68/go.mod h1:fujopn7TB3Pu3JM69XaawiU0wqjpL9/8xGop5UrTPps= +github.com/miekg/dns v1.1.72 h1:vhmr+TF2A3tuoGNkLDFK9zi36F2LS+hKTRW0Uf8kbzI= +github.com/miekg/dns v1.1.72/go.mod h1:+EuEPhdHOsfk6Wk5TT2CzssZdqkmFhf8r+aVyDEToIs= github.com/minio/selfupdate v0.6.1-0.20230907112617-f11e74f84ca7 h1:yRZGarbxsRytL6EGgbqK2mCY+Lk5MWKQYKJT2gEglhc= github.com/minio/selfupdate v0.6.1-0.20230907112617-f11e74f84ca7/go.mod h1:bO02GTIPCMQFTEvE5h4DjYB58bCoZ35XLeBf0buTDdM= github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= @@ -254,8 +254,8 @@ github.com/projectdiscovery/awesome-search-queries v0.0.0-20260104120501-961ef30 github.com/projectdiscovery/awesome-search-queries v0.0.0-20260104120501-961ef30f7193/go.mod h1:nSovPcipgSx/EzAefF+iCfORolkKAuodiRWL3RCGHOM= github.com/projectdiscovery/blackrock v0.0.1 h1:lHQqhaaEFjgf5WkuItbpeCZv2DUIE45k0VbGJyft6LQ= github.com/projectdiscovery/blackrock v0.0.1/go.mod h1:ANUtjDfaVrqB453bzToU+YB4cUbvBRpLvEwoWIwlTss= -github.com/projectdiscovery/cdncheck v1.2.45 h1:OUInJ7JrbCTikb5vIax1Z4d31O1hlnnxGaaZ9FOyIKQ= -github.com/projectdiscovery/cdncheck v1.2.45/go.mod h1:9oE9KKxCSHNvUf0UaMeqqUwWpC38FkNaTll0ScIBT3w= +github.com/projectdiscovery/cdncheck v1.2.46 h1:ELtTCaT5dLigd0FGmw6z+JuIpbFAr422hbgAFXMmKvY= +github.com/projectdiscovery/cdncheck v1.2.46/go.mod h1:9oE9KKxCSHNvUf0UaMeqqUwWpC38FkNaTll0ScIBT3w= github.com/projectdiscovery/clistats v0.1.4 h1:kDnXoNxIdOvQElOF7k2Mt6XosGa5GbMKPtRXdPHMVzU= github.com/projectdiscovery/clistats v0.1.4/go.mod h1:hjJYNcUubk9T3cuFvA+JkLhZGjzYW50fkC48dqUAtbU= github.com/projectdiscovery/dsl v0.8.20 h1:CxWcKuoHFpOSS1kzqnbJuK5No/6qoRG8IzNDMnZ6c/M= @@ -268,8 +268,8 @@ github.com/projectdiscovery/freeport v0.0.7 h1:Q6uXo/j8SaV/GlAHkEYQi8WQoPXyJWxys github.com/projectdiscovery/freeport v0.0.7/go.mod h1:cOhWKvNBe9xM6dFJ3RrrLvJ5vXx2NQ36SecuwjenV2k= github.com/projectdiscovery/goconfig v0.0.1 h1:36m3QjohZvemqh9bkJAakaHsm9iEZ2AcQSS18+0QX/s= github.com/projectdiscovery/goconfig v0.0.1/go.mod h1:CPO25zR+mzTtyBrsygqsHse0sp/4vB/PjaHi9upXlDw= -github.com/projectdiscovery/goflags v0.1.74 h1:n85uTRj5qMosm0PFBfsvOL24I7TdWRcWq/1GynhXS7c= -github.com/projectdiscovery/goflags v0.1.74/go.mod h1:UMc9/7dFz2oln+10tv6cy+7WZKTHf9UGhaNkF95emh4= +github.com/projectdiscovery/goflags v0.1.75 h1:njEBnyueQaFa2ptWxbyl9zX0OClNdlN2AzZveNHiBOs= +github.com/projectdiscovery/goflags v0.1.75/go.mod h1:7nAP1r2Dqgn/rwmOE3EWbZWUCEJKNIhVSBGpuzJAIns= github.com/projectdiscovery/gologger v1.1.71 h1:IYU4mw9viKdSzMTIGVpYuw1Gtg7QIHIStqAQgeNXcBQ= github.com/projectdiscovery/gologger v1.1.71/go.mod h1:mJwODZcFDg70ihINpOvZevmBtgvpP8H9/l8Y+OPhZPY= github.com/projectdiscovery/gostruct v0.0.2 h1:s8gP8ApugGM4go1pA+sVlPDXaWqNP5BBDDSv7VEdG1M= @@ -282,16 +282,16 @@ github.com/projectdiscovery/machineid v0.0.0-20250715113114-c77eb3567582 h1:eR+0 github.com/projectdiscovery/machineid v0.0.0-20250715113114-c77eb3567582/go.mod h1:3G3BRKui7nMuDFAZKR/M2hiOLtaOmyukT20g88qRQjI= github.com/projectdiscovery/mapcidr v1.1.97 h1:7FkxNNVXp+m1rIu5Nv/2SrF9k4+LwP8QuWs2puwy+2w= github.com/projectdiscovery/mapcidr v1.1.97/go.mod h1:9dgTJh1SP02gYZdpzMjm6vtYFkEHQHoTyaVNvaeJ7lA= -github.com/projectdiscovery/networkpolicy v0.1.42 h1:/d5vriH8fDMoEaFCSD1nuCWs/ki3dft+CDqQnYrKyLg= -github.com/projectdiscovery/networkpolicy v0.1.42/go.mod h1:9ULLaMbdv9UnT0C5rmuK4nIwYs0o776xMnkPUb8TtaE= +github.com/projectdiscovery/networkpolicy v0.1.43 h1:USAkEEYilhsN7v917wtFBUf+k8i0LOwJMcdds4HYKMU= +github.com/projectdiscovery/networkpolicy v0.1.43/go.mod h1:X2qj1V2rrahnWG8SntJBao3FG01eEpdNrIKnQfpzE70= github.com/projectdiscovery/ratelimit v0.0.88 h1:AcurW9aLRzlEyPe9kSjnOpr3XzLMWTpiWAlW/w73ALU= github.com/projectdiscovery/ratelimit v0.0.88/go.mod h1:CU1s+68UUG2mctSl2wi32/DHLJA6TMg+4rxgP59LfVk= -github.com/projectdiscovery/rawhttp v0.1.90 h1:LOSZ6PUH08tnKmWsIwvwv1Z/4zkiYKYOSZ6n+8RFKtw= -github.com/projectdiscovery/rawhttp v0.1.90/go.mod h1:VZYAM25UI/wVB3URZ95ZaftgOnsbphxyAw/XnQRRz4Y= +github.com/projectdiscovery/rawhttp v0.1.91 h1:6EIhZxCkBn27kJAl47FieCFCe4H2ZdbhoBVj0J6ZCVY= +github.com/projectdiscovery/rawhttp v0.1.91/go.mod h1:VZYAM25UI/wVB3URZ95ZaftgOnsbphxyAw/XnQRRz4Y= github.com/projectdiscovery/retryabledns v1.0.115 h1:RKV63FNIznFHUoawg/1hs53pVH3wqPtFhwstCuxVSoA= github.com/projectdiscovery/retryabledns v1.0.115/go.mod h1:+fEMWoPigw+M0lGNKY7AZ+g8FIgj+4sONjsinMmeL3k= -github.com/projectdiscovery/retryablehttp-go v1.3.19 h1:WUmMV+sD4BZBT9aOCNZXtXM1maBlMLkPQSi4xiy8mhg= -github.com/projectdiscovery/retryablehttp-go v1.3.19/go.mod h1:Cdd/nTPQe5PiCyFjrJaxWZJmLnKomAnLvR+WOC8J6Xw= +github.com/projectdiscovery/retryablehttp-go v1.3.20 h1:5kj09jtEag2wvn/0fYCT60hz2RydHcysFTFT4Si5cX4= +github.com/projectdiscovery/retryablehttp-go v1.3.20/go.mod h1:Cdd/nTPQe5PiCyFjrJaxWZJmLnKomAnLvR+WOC8J6Xw= github.com/projectdiscovery/stringsutil v0.0.2 h1:uzmw3IVLJSMW1kEg8eCStG/cGbYYZAja8BH3LqqJXMA= github.com/projectdiscovery/stringsutil v0.0.2/go.mod h1:EJ3w6bC5fBYjVou6ryzodQq37D5c6qbAYQpGmAy+DC0= github.com/projectdiscovery/tlsx v1.2.2 h1:Y96QBqeD2anpzEtBl4kqNbwzXh2TrzJuXfgiBLvK+SE= @@ -300,8 +300,8 @@ github.com/projectdiscovery/useragent v0.0.108 h1:fb+uLuFJvC+MHZjCtxQJxtvp1X6A8n github.com/projectdiscovery/useragent v0.0.108/go.mod h1:XdNRrlvtDmYfVL1Oybat4uMe+W6cLwsK9S18ond17CI= github.com/projectdiscovery/utils v0.11.1 h1:PWj1KjIASxt8icxommH72C0TQqNOvGkcSODRkiq0SQw= github.com/projectdiscovery/utils v0.11.1/go.mod h1:yktGrHGk2CTjNiccXovnvGrLHX9sV2bqz9nSnbA3V8M= -github.com/projectdiscovery/wappalyzergo v0.2.90 h1:fuzStSlVB5RHmbKz5CScvEbxRnBoIyYCn7oh1xQRuvo= -github.com/projectdiscovery/wappalyzergo v0.2.90/go.mod h1:gMH0o5lBp65sKMwHx/tuUdOtW2RjodC6Ti+9QDsYMkY= +github.com/projectdiscovery/wappalyzergo v0.2.91 h1:pjbEOCJKmxfEG5xK3WnUNY4SuYjPoYUuAUxa3F1QN1Y= +github.com/projectdiscovery/wappalyzergo v0.2.91/go.mod h1:gMH0o5lBp65sKMwHx/tuUdOtW2RjodC6Ti+9QDsYMkY= github.com/refraction-networking/utls v1.8.2 h1:j4Q1gJj0xngdeH+Ox/qND11aEfhpgoEvV+S9iJ2IdQo= github.com/refraction-networking/utls v1.8.2/go.mod h1:jkSOEkLqn+S/jtpEHPOsVv/4V4EVnelwbMQl4vCWXAM= github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= @@ -442,8 +442,8 @@ golang.org/x/crypto v0.25.0/go.mod h1:T+wALwcMOSE0kXgUAnPAHqTLW+XHgcELELW8VaDgm/ golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk= golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw= golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk= -golang.org/x/exp v0.0.0-20250911091902-df9299821621 h1:2id6c1/gto0kaHYyrixvknJ8tUK/Qs5IsmBtrc+FtgU= -golang.org/x/exp v0.0.0-20250911091902-df9299821621/go.mod h1:TwQYMMnGpvZyc+JpB/UAuTNIsVJifOlSkrZkhcvpVUk= +golang.org/x/exp v0.0.0-20260112195511-716be5621a96 h1:Z/6YuSHTLOHfNFdb8zVZomZr7cqNgTJvA8+Qz75D8gU= +golang.org/x/exp v0.0.0-20260112195511-716be5621a96/go.mod h1:nzimsREAkjBCIEFtHiYkrJyT+2uy9YZJB7H1k68CXZU= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= From ca92e9fd7639e1e7485f2590acb785030c571cdc Mon Sep 17 00:00:00 2001 From: tlhsec Date: Wed, 5 Aug 2026 12:49:30 +0100 Subject: [PATCH 22/32] fix: pdcp data loss, pipeline conn leak, Close() race, FilterCustom error swallowing --- common/httpx/filter.go | 7 +++-- common/httpx/filter_test.go | 55 +++++++++++++++++++++++++++++++++++++ common/httpx/pipeline.go | 1 + internal/pdcp/writer.go | 11 +++++--- 4 files changed, 68 insertions(+), 6 deletions(-) create mode 100644 common/httpx/filter_test.go diff --git a/common/httpx/filter.go b/common/httpx/filter.go index e553abcbb..44ac72ef0 100644 --- a/common/httpx/filter.go +++ b/common/httpx/filter.go @@ -53,8 +53,11 @@ type FilterCustom struct { func (f FilterCustom) Filter(response *Response) (bool, error) { for _, callback := range f.CallBacks { ok, err := callback(response) - if ok && err == nil { - return true, err + if err != nil { + return false, err + } + if ok { + return true, nil } } diff --git a/common/httpx/filter_test.go b/common/httpx/filter_test.go new file mode 100644 index 000000000..9a163183a --- /dev/null +++ b/common/httpx/filter_test.go @@ -0,0 +1,55 @@ +package httpx + +import ( + "errors" + "testing" + + "github.com/stretchr/testify/require" +) + +func TestFilterCustomErrorPropagation(t *testing.T) { + t.Run("error from callback is returned, not swallowed", func(t *testing.T) { + expectedErr := errors.New("callback failure") + callback := func(response *Response) (bool, error) { + return true, expectedErr + } + filter := FilterCustom{CallBacks: []CustomCallback{callback}} + ok, err := filter.Filter(&Response{}) + require.False(t, ok, "ok should be false when callback returns an error") + require.ErrorIs(t, err, expectedErr, "error from callback should be propagated") + }) + + t.Run("error from callback with ok=false is returned", func(t *testing.T) { + expectedErr := errors.New("callback failure") + callback := func(response *Response) (bool, error) { + return false, expectedErr + } + filter := FilterCustom{CallBacks: []CustomCallback{callback}} + ok, err := filter.Filter(&Response{}) + require.False(t, ok) + require.ErrorIs(t, err, expectedErr) + }) + + t.Run("first matching callback without error returns true", func(t *testing.T) { + callbacks := []CustomCallback{ + func(response *Response) (bool, error) { return false, nil }, + func(response *Response) (bool, error) { return true, nil }, + func(response *Response) (bool, error) { return true, nil }, + } + filter := FilterCustom{CallBacks: callbacks} + ok, err := filter.Filter(&Response{}) + require.True(t, ok) + require.NoError(t, err) + }) + + t.Run("no callbacks match returns false with nil error", func(t *testing.T) { + callbacks := []CustomCallback{ + func(response *Response) (bool, error) { return false, nil }, + func(response *Response) (bool, error) { return false, nil }, + } + filter := FilterCustom{CallBacks: callbacks} + ok, err := filter.Filter(&Response{}) + require.False(t, ok) + require.NoError(t, err) + }) +} diff --git a/common/httpx/pipeline.go b/common/httpx/pipeline.go index b6b7b7817..d804833f5 100644 --- a/common/httpx/pipeline.go +++ b/common/httpx/pipeline.go @@ -29,6 +29,7 @@ func (h *HTTPX) SupportPipeline(protocol, method, host string, port int) bool { if err != nil { return false } + defer conn.Close() // send some probes nprobes := 10 for i := 0; i < nprobes; i++ { diff --git a/internal/pdcp/writer.go b/internal/pdcp/writer.go index fbad91abd..06ee03999 100644 --- a/internal/pdcp/writer.go +++ b/internal/pdcp/writer.go @@ -174,6 +174,9 @@ func (u *UploadWriter) autoCommit(ctx context.Context) { if err := u.uploadChunk(buff); err != nil { gologger.Error().Msgf("Failed to upload asset results on cloud: %v", err) } + // write the current line to the now-empty buffer so it is not lost + buff.WriteString(line) + buff.WriteString("\n") } else { buff.WriteString(line) buff.WriteString("\n") @@ -261,10 +264,10 @@ func (u *UploadWriter) getRequest(bin []byte) (*retryablehttp.Request, error) { // Close closes the upload writer func (u *UploadWriter) Close() { - if !u.closed.Load() { - // protect to avoid channel closed twice error - close(u.data) - u.closed.Store(true) + // atomically ensure we only close the channel once + if !u.closed.CompareAndSwap(false, true) { + return } + close(u.data) <-u.done } From 3bee964d0f9aae649d49bdc680fff40539a326f2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Do=C4=9Fan=20Can=20Bak=C4=B1r?= Date: Tue, 11 Aug 2026 17:56:02 -0700 Subject: [PATCH 23/32] fix: make binary body test use a local server Closes #2552 --- common/httpx/httpx_test.go | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/common/httpx/httpx_test.go b/common/httpx/httpx_test.go index a58d61014..b2910e147 100644 --- a/common/httpx/httpx_test.go +++ b/common/httpx/httpx_test.go @@ -2,6 +2,7 @@ package httpx import ( "net/http" + "net/http/httptest" "testing" "time" @@ -22,11 +23,19 @@ func TestDo(t *testing.T) { }) t.Run("content-length with binary body", func(t *testing.T) { - req, err := retryablehttp.NewRequest(http.MethodGet, "https://www.w3schools.com/images/favicon.ico", nil) + body := []byte{0x47, 0x49, 0x46, 0x38, 0x39, 0x61, 0x00, 0x01, 0x00, 0x01, 0x80, 0x00, 0x00, 0xff} + srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { + w.Header().Set("Content-Type", "image/gif") + _, _ = w.Write(body) + })) + defer srv.Close() + + req, err := retryablehttp.NewRequest(http.MethodGet, srv.URL, nil) require.Nil(t, err) resp, err := ht.Do(req, UnsafeOptions{}) require.Nil(t, err) - require.Greater(t, len(resp.Raw), 800) + require.Equal(t, len(body), resp.ContentLength) + require.Equal(t, body, resp.RawData) }) } From 4e7e70ee338070bb835dc7d402f811452251c52c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 19 Aug 2026 10:13:18 +0000 Subject: [PATCH 24/32] chore(deps): bump the projectdiscovery group across 1 directory with 10 updates Bumps the projectdiscovery group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/projectdiscovery/cdncheck](https://github.com/projectdiscovery/cdncheck) | `1.2.46` | `1.2.49` | | [github.com/projectdiscovery/clistats](https://github.com/projectdiscovery/clistats) | `0.1.4` | `0.1.5` | | [github.com/projectdiscovery/dsl](https://github.com/projectdiscovery/dsl) | `0.8.20` | `0.8.21` | | [github.com/projectdiscovery/fastdialer](https://github.com/projectdiscovery/fastdialer) | `0.5.13` | `0.5.16` | | [github.com/projectdiscovery/goflags](https://github.com/projectdiscovery/goflags) | `0.1.75` | `0.1.76` | | [github.com/projectdiscovery/gologger](https://github.com/projectdiscovery/gologger) | `1.1.71` | `1.1.72` | | [github.com/projectdiscovery/retryablehttp-go](https://github.com/projectdiscovery/retryablehttp-go) | `1.3.20` | `1.3.23` | | [github.com/projectdiscovery/tlsx](https://github.com/projectdiscovery/tlsx) | `1.2.2` | `1.3.2` | | [github.com/projectdiscovery/wappalyzergo](https://github.com/projectdiscovery/wappalyzergo) | `0.2.91` | `0.2.94` | Updates `github.com/projectdiscovery/cdncheck` from 1.2.46 to 1.2.49 - [Release notes](https://github.com/projectdiscovery/cdncheck/releases) - [Commits](https://github.com/projectdiscovery/cdncheck/compare/v1.2.46...v1.2.49) Updates `github.com/projectdiscovery/clistats` from 0.1.4 to 0.1.5 - [Release notes](https://github.com/projectdiscovery/clistats/releases) - [Commits](https://github.com/projectdiscovery/clistats/compare/v0.1.4...v0.1.5) Updates `github.com/projectdiscovery/dsl` from 0.8.20 to 0.8.21 - [Release notes](https://github.com/projectdiscovery/dsl/releases) - [Commits](https://github.com/projectdiscovery/dsl/compare/v0.8.20...v0.8.21) Updates `github.com/projectdiscovery/fastdialer` from 0.5.13 to 0.5.16 - [Release notes](https://github.com/projectdiscovery/fastdialer/releases) - [Commits](https://github.com/projectdiscovery/fastdialer/compare/v0.5.13...v0.5.16) Updates `github.com/projectdiscovery/goflags` from 0.1.75 to 0.1.76 - [Release notes](https://github.com/projectdiscovery/goflags/releases) - [Commits](https://github.com/projectdiscovery/goflags/compare/v0.1.75...v0.1.76) Updates `github.com/projectdiscovery/gologger` from 1.1.71 to 1.1.72 - [Release notes](https://github.com/projectdiscovery/gologger/releases) - [Commits](https://github.com/projectdiscovery/gologger/compare/v1.1.71...v1.1.72) Updates `github.com/projectdiscovery/networkpolicy` from 0.1.43 to 0.1.45 - [Release notes](https://github.com/projectdiscovery/networkpolicy/releases) - [Commits](https://github.com/projectdiscovery/networkpolicy/compare/v0.1.43...v0.1.45) Updates `github.com/projectdiscovery/retryablehttp-go` from 1.3.20 to 1.3.23 - [Release notes](https://github.com/projectdiscovery/retryablehttp-go/releases) - [Commits](https://github.com/projectdiscovery/retryablehttp-go/compare/v1.3.20...v1.3.23) Updates `github.com/projectdiscovery/tlsx` from 1.2.2 to 1.3.2 - [Release notes](https://github.com/projectdiscovery/tlsx/releases) - [Commits](https://github.com/projectdiscovery/tlsx/commits) Updates `github.com/projectdiscovery/wappalyzergo` from 0.2.91 to 0.2.94 - [Release notes](https://github.com/projectdiscovery/wappalyzergo/releases) - [Commits](https://github.com/projectdiscovery/wappalyzergo/compare/v0.2.91...v0.2.94) --- updated-dependencies: - dependency-name: github.com/projectdiscovery/cdncheck dependency-version: 1.2.49 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: projectdiscovery - dependency-name: github.com/projectdiscovery/clistats dependency-version: 0.1.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: projectdiscovery - dependency-name: github.com/projectdiscovery/dsl dependency-version: 0.8.21 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: projectdiscovery - dependency-name: github.com/projectdiscovery/fastdialer dependency-version: 0.5.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: projectdiscovery - dependency-name: github.com/projectdiscovery/goflags dependency-version: 0.1.76 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: projectdiscovery - dependency-name: github.com/projectdiscovery/gologger dependency-version: 1.1.72 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: projectdiscovery - dependency-name: github.com/projectdiscovery/networkpolicy dependency-version: 0.1.45 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: projectdiscovery - dependency-name: github.com/projectdiscovery/retryablehttp-go dependency-version: 1.3.23 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: projectdiscovery - dependency-name: github.com/projectdiscovery/tlsx dependency-version: 1.3.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: projectdiscovery - dependency-name: github.com/projectdiscovery/wappalyzergo dependency-version: 0.2.94 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: projectdiscovery ... Signed-off-by: dependabot[bot] --- go.mod | 24 ++++++++++++------------ go.sum | 48 ++++++++++++++++++++++++------------------------ 2 files changed, 36 insertions(+), 36 deletions(-) diff --git a/go.mod b/go.mod index df46a3bd2..ba966212a 100644 --- a/go.mod +++ b/go.mod @@ -19,24 +19,24 @@ require ( github.com/miekg/dns v1.1.72 // indirect github.com/pkg/errors v0.9.1 github.com/projectdiscovery/asnmap v1.1.1 - github.com/projectdiscovery/cdncheck v1.2.46 - github.com/projectdiscovery/clistats v0.1.4 - github.com/projectdiscovery/dsl v0.8.20 - github.com/projectdiscovery/fastdialer v0.5.13 + github.com/projectdiscovery/cdncheck v1.2.49 + github.com/projectdiscovery/clistats v0.1.5 + github.com/projectdiscovery/dsl v0.8.21 + github.com/projectdiscovery/fastdialer v0.5.16 github.com/projectdiscovery/fdmax v0.0.4 github.com/projectdiscovery/goconfig v0.0.1 - github.com/projectdiscovery/goflags v0.1.75 - github.com/projectdiscovery/gologger v1.1.71 + github.com/projectdiscovery/goflags v0.1.76 + github.com/projectdiscovery/gologger v1.1.72 github.com/projectdiscovery/hmap v0.0.101 github.com/projectdiscovery/mapcidr v1.1.97 - github.com/projectdiscovery/networkpolicy v0.1.43 + github.com/projectdiscovery/networkpolicy v0.1.45 github.com/projectdiscovery/ratelimit v0.0.88 github.com/projectdiscovery/rawhttp v0.1.91 - github.com/projectdiscovery/retryablehttp-go v1.3.20 - github.com/projectdiscovery/tlsx v1.2.2 + github.com/projectdiscovery/retryablehttp-go v1.3.23 + github.com/projectdiscovery/tlsx v1.3.2 github.com/projectdiscovery/useragent v0.0.108 github.com/projectdiscovery/utils v0.11.1 - github.com/projectdiscovery/wappalyzergo v0.2.91 + github.com/projectdiscovery/wappalyzergo v0.2.94 github.com/rs/xid v1.6.0 github.com/spaolacci/murmur3 v1.1.0 github.com/stretchr/testify v1.11.1 @@ -92,7 +92,7 @@ require ( github.com/ebitengine/purego v0.10.0 // indirect github.com/fatih/color v1.18.0 // indirect github.com/felixge/fgprof v0.9.5 // indirect - github.com/gaissmai/bart v0.28.1 // indirect + github.com/gaissmai/bart v0.29.0 // indirect github.com/go-ole/go-ole v1.2.6 // indirect github.com/go-sourcemap/sourcemap v2.1.3+incompatible // indirect github.com/google/certificate-transparency-go v1.3.2 // indirect @@ -124,7 +124,7 @@ require ( github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646 // indirect github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect - github.com/projectdiscovery/blackrock v0.0.1 // indirect + github.com/projectdiscovery/blackrock v0.0.2 // indirect github.com/projectdiscovery/freeport v0.0.7 // indirect github.com/projectdiscovery/gostruct v0.0.2 // indirect github.com/projectdiscovery/govaluate v0.0.0-20260504230327-80320480bb6e // indirect diff --git a/go.sum b/go.sum index 02bfcd411..6f4ab46b4 100644 --- a/go.sum +++ b/go.sum @@ -96,8 +96,8 @@ github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7z github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo= github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY= github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw= -github.com/gaissmai/bart v0.28.1 h1:1YhWqAcQaFklvhRd8x0FHA9qUCmArfqEwaORVkV2s6k= -github.com/gaissmai/bart v0.28.1/go.mod h1:GREWQfTLRWz/c5FTOsIw+KkscuFkIV5t8Rp7Nd1Td5c= +github.com/gaissmai/bart v0.29.0 h1:wO6HGE8g9YE0Wm0bCpYxwRzfQ4+fbJKOhL64e5ACGCI= +github.com/gaissmai/bart v0.29.0/go.mod h1:GREWQfTLRWz/c5FTOsIw+KkscuFkIV5t8Rp7Nd1Td5c= github.com/go-faker/faker/v4 v4.10.0 h1:rHTZVwG1x8aN4zXDYJUFucOGDQojuxOby5MTdC/M2Fw= github.com/go-faker/faker/v4 v4.10.0/go.mod h1:X+KzPB4JZ82GY4MYr7NV7zmp+i/K0SG5EDKqIg5zd1k= github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY= @@ -252,26 +252,26 @@ github.com/projectdiscovery/asnmap v1.1.1 h1:ImJiKIaACOT7HPx4Pabb5dksolzaFYsD1kI github.com/projectdiscovery/asnmap v1.1.1/go.mod h1:QT7jt9nQanj+Ucjr9BqGr1Q2veCCKSAVyUzLXfEcQ60= github.com/projectdiscovery/awesome-search-queries v0.0.0-20260104120501-961ef30f7193 h1:UCZRqs1BP1wsvhCwQxfIQc7NJcXGBhQvAnEw3awhsng= github.com/projectdiscovery/awesome-search-queries v0.0.0-20260104120501-961ef30f7193/go.mod h1:nSovPcipgSx/EzAefF+iCfORolkKAuodiRWL3RCGHOM= -github.com/projectdiscovery/blackrock v0.0.1 h1:lHQqhaaEFjgf5WkuItbpeCZv2DUIE45k0VbGJyft6LQ= -github.com/projectdiscovery/blackrock v0.0.1/go.mod h1:ANUtjDfaVrqB453bzToU+YB4cUbvBRpLvEwoWIwlTss= -github.com/projectdiscovery/cdncheck v1.2.46 h1:ELtTCaT5dLigd0FGmw6z+JuIpbFAr422hbgAFXMmKvY= -github.com/projectdiscovery/cdncheck v1.2.46/go.mod h1:9oE9KKxCSHNvUf0UaMeqqUwWpC38FkNaTll0ScIBT3w= -github.com/projectdiscovery/clistats v0.1.4 h1:kDnXoNxIdOvQElOF7k2Mt6XosGa5GbMKPtRXdPHMVzU= -github.com/projectdiscovery/clistats v0.1.4/go.mod h1:hjJYNcUubk9T3cuFvA+JkLhZGjzYW50fkC48dqUAtbU= -github.com/projectdiscovery/dsl v0.8.20 h1:CxWcKuoHFpOSS1kzqnbJuK5No/6qoRG8IzNDMnZ6c/M= -github.com/projectdiscovery/dsl v0.8.20/go.mod h1:e1oHi7mxAxF+UhBhD5gOk90Ga6LQqvFea2voMO1E5D0= -github.com/projectdiscovery/fastdialer v0.5.13 h1:Tocdk3yy7WKLmRV1YmWctPI2yU1QfJIlUbMarIzdgGg= -github.com/projectdiscovery/fastdialer v0.5.13/go.mod h1:iSf7DMOttk4LH/YSNAaztliqVCo1cVlmyudR+YXJWW8= +github.com/projectdiscovery/blackrock v0.0.2 h1:mxXdu0uM8P2L2Qi210COlU8QiICPFW/Rxk5QUhlPO2k= +github.com/projectdiscovery/blackrock v0.0.2/go.mod h1:ANUtjDfaVrqB453bzToU+YB4cUbvBRpLvEwoWIwlTss= +github.com/projectdiscovery/cdncheck v1.2.49 h1:f1k74Nvwo44gbOmKPh132J/EcrX0uKGTJJD+acVlzFY= +github.com/projectdiscovery/cdncheck v1.2.49/go.mod h1:9oE9KKxCSHNvUf0UaMeqqUwWpC38FkNaTll0ScIBT3w= +github.com/projectdiscovery/clistats v0.1.5 h1:kHhRWZGTrXUBzKAnZ7sY1G15JIA+DuzxopN1k5SxaOg= +github.com/projectdiscovery/clistats v0.1.5/go.mod h1:hjJYNcUubk9T3cuFvA+JkLhZGjzYW50fkC48dqUAtbU= +github.com/projectdiscovery/dsl v0.8.21 h1:LXz0T5AjWyIyTbmsjdjutnucaRPMein1gVdoxwtJxZY= +github.com/projectdiscovery/dsl v0.8.21/go.mod h1:AX4IYLANTX7vFyBm7szaFwtdLr3awAlGpSp3cYIYBPM= +github.com/projectdiscovery/fastdialer v0.5.16 h1:cds7enBT8YFDjGuBVJu7K0J2H0KVnPIrwFf3gJCSkLY= +github.com/projectdiscovery/fastdialer v0.5.16/go.mod h1:+eYcmH0Fp6IhHtnr/FeFyjg1jT7efcFT/O8WcvTMsX4= github.com/projectdiscovery/fdmax v0.0.4 h1:K9tIl5MUZrEMzjvwn/G4drsHms2aufTn1xUdeVcmhmc= github.com/projectdiscovery/fdmax v0.0.4/go.mod h1:oZLqbhMuJ5FmcoaalOm31B1P4Vka/CqP50nWjgtSz+I= github.com/projectdiscovery/freeport v0.0.7 h1:Q6uXo/j8SaV/GlAHkEYQi8WQoPXyJWxyspx+aFmz9Qk= github.com/projectdiscovery/freeport v0.0.7/go.mod h1:cOhWKvNBe9xM6dFJ3RrrLvJ5vXx2NQ36SecuwjenV2k= github.com/projectdiscovery/goconfig v0.0.1 h1:36m3QjohZvemqh9bkJAakaHsm9iEZ2AcQSS18+0QX/s= github.com/projectdiscovery/goconfig v0.0.1/go.mod h1:CPO25zR+mzTtyBrsygqsHse0sp/4vB/PjaHi9upXlDw= -github.com/projectdiscovery/goflags v0.1.75 h1:njEBnyueQaFa2ptWxbyl9zX0OClNdlN2AzZveNHiBOs= -github.com/projectdiscovery/goflags v0.1.75/go.mod h1:7nAP1r2Dqgn/rwmOE3EWbZWUCEJKNIhVSBGpuzJAIns= -github.com/projectdiscovery/gologger v1.1.71 h1:IYU4mw9viKdSzMTIGVpYuw1Gtg7QIHIStqAQgeNXcBQ= -github.com/projectdiscovery/gologger v1.1.71/go.mod h1:mJwODZcFDg70ihINpOvZevmBtgvpP8H9/l8Y+OPhZPY= +github.com/projectdiscovery/goflags v0.1.76 h1:4OnNU4hvzVdOc+7wcIYBnPOHzo0BcTJ5lC6hS/TeUkA= +github.com/projectdiscovery/goflags v0.1.76/go.mod h1:7nAP1r2Dqgn/rwmOE3EWbZWUCEJKNIhVSBGpuzJAIns= +github.com/projectdiscovery/gologger v1.1.72 h1:PKk+aSx3jYOCBPi+FD+nTnhe+Vxx9u3K7Ega0GVlMCI= +github.com/projectdiscovery/gologger v1.1.72/go.mod h1:mJwODZcFDg70ihINpOvZevmBtgvpP8H9/l8Y+OPhZPY= github.com/projectdiscovery/gostruct v0.0.2 h1:s8gP8ApugGM4go1pA+sVlPDXaWqNP5BBDDSv7VEdG1M= github.com/projectdiscovery/gostruct v0.0.2/go.mod h1:H86peL4HKwMXcQQtEa6lmC8FuD9XFt6gkNR0B/Mu5PE= github.com/projectdiscovery/govaluate v0.0.0-20260504230327-80320480bb6e h1:o+ulEIaC2+9V2Ezr6mI5xEhKWsf0V/+FUQIS723Aj6U= @@ -282,26 +282,26 @@ github.com/projectdiscovery/machineid v0.0.0-20250715113114-c77eb3567582 h1:eR+0 github.com/projectdiscovery/machineid v0.0.0-20250715113114-c77eb3567582/go.mod h1:3G3BRKui7nMuDFAZKR/M2hiOLtaOmyukT20g88qRQjI= github.com/projectdiscovery/mapcidr v1.1.97 h1:7FkxNNVXp+m1rIu5Nv/2SrF9k4+LwP8QuWs2puwy+2w= github.com/projectdiscovery/mapcidr v1.1.97/go.mod h1:9dgTJh1SP02gYZdpzMjm6vtYFkEHQHoTyaVNvaeJ7lA= -github.com/projectdiscovery/networkpolicy v0.1.43 h1:USAkEEYilhsN7v917wtFBUf+k8i0LOwJMcdds4HYKMU= -github.com/projectdiscovery/networkpolicy v0.1.43/go.mod h1:X2qj1V2rrahnWG8SntJBao3FG01eEpdNrIKnQfpzE70= +github.com/projectdiscovery/networkpolicy v0.1.45 h1:Hg3j9XiMC2MAJs1r5ydIJzGVfPxGS++FAM6VdRPPOR0= +github.com/projectdiscovery/networkpolicy v0.1.45/go.mod h1:q1KeQiHchXdElScEMWc5mShWNRNoJXI5koRnVaX6Qh8= github.com/projectdiscovery/ratelimit v0.0.88 h1:AcurW9aLRzlEyPe9kSjnOpr3XzLMWTpiWAlW/w73ALU= github.com/projectdiscovery/ratelimit v0.0.88/go.mod h1:CU1s+68UUG2mctSl2wi32/DHLJA6TMg+4rxgP59LfVk= github.com/projectdiscovery/rawhttp v0.1.91 h1:6EIhZxCkBn27kJAl47FieCFCe4H2ZdbhoBVj0J6ZCVY= github.com/projectdiscovery/rawhttp v0.1.91/go.mod h1:VZYAM25UI/wVB3URZ95ZaftgOnsbphxyAw/XnQRRz4Y= github.com/projectdiscovery/retryabledns v1.0.115 h1:RKV63FNIznFHUoawg/1hs53pVH3wqPtFhwstCuxVSoA= github.com/projectdiscovery/retryabledns v1.0.115/go.mod h1:+fEMWoPigw+M0lGNKY7AZ+g8FIgj+4sONjsinMmeL3k= -github.com/projectdiscovery/retryablehttp-go v1.3.20 h1:5kj09jtEag2wvn/0fYCT60hz2RydHcysFTFT4Si5cX4= -github.com/projectdiscovery/retryablehttp-go v1.3.20/go.mod h1:Cdd/nTPQe5PiCyFjrJaxWZJmLnKomAnLvR+WOC8J6Xw= +github.com/projectdiscovery/retryablehttp-go v1.3.23 h1:s5gsGP7sWJvss1Xeb06Y5TRux8pXvA/xXPCWdPBHOQ8= +github.com/projectdiscovery/retryablehttp-go v1.3.23/go.mod h1:dnzMyBzMmaTHYp5caYCd8mge23qhTGcBjIJ9SagdQ4Q= github.com/projectdiscovery/stringsutil v0.0.2 h1:uzmw3IVLJSMW1kEg8eCStG/cGbYYZAja8BH3LqqJXMA= github.com/projectdiscovery/stringsutil v0.0.2/go.mod h1:EJ3w6bC5fBYjVou6ryzodQq37D5c6qbAYQpGmAy+DC0= -github.com/projectdiscovery/tlsx v1.2.2 h1:Y96QBqeD2anpzEtBl4kqNbwzXh2TrzJuXfgiBLvK+SE= -github.com/projectdiscovery/tlsx v1.2.2/go.mod h1:ZJl9F1sSl0sdwE+lR0yuNHVX4Zx6tCSTqnNxnHCFZB4= +github.com/projectdiscovery/tlsx v1.3.2 h1:1Lh2ith79o8R+rOOSBZiMq8EiZ8j4D3T/8ENO+gAqXA= +github.com/projectdiscovery/tlsx v1.3.2/go.mod h1:2wgTGC/sourHvoR+RX8cAok0Sa8YK6QbEP3xo5SDzPI= github.com/projectdiscovery/useragent v0.0.108 h1:fb+uLuFJvC+MHZjCtxQJxtvp1X6A8n98CUGPyFcg3NE= github.com/projectdiscovery/useragent v0.0.108/go.mod h1:XdNRrlvtDmYfVL1Oybat4uMe+W6cLwsK9S18ond17CI= github.com/projectdiscovery/utils v0.11.1 h1:PWj1KjIASxt8icxommH72C0TQqNOvGkcSODRkiq0SQw= github.com/projectdiscovery/utils v0.11.1/go.mod h1:yktGrHGk2CTjNiccXovnvGrLHX9sV2bqz9nSnbA3V8M= -github.com/projectdiscovery/wappalyzergo v0.2.91 h1:pjbEOCJKmxfEG5xK3WnUNY4SuYjPoYUuAUxa3F1QN1Y= -github.com/projectdiscovery/wappalyzergo v0.2.91/go.mod h1:gMH0o5lBp65sKMwHx/tuUdOtW2RjodC6Ti+9QDsYMkY= +github.com/projectdiscovery/wappalyzergo v0.2.94 h1:uHyNIb5OFLzyvEd6v64JLoc7Dlg3dBSjlPyjCIz0+T8= +github.com/projectdiscovery/wappalyzergo v0.2.94/go.mod h1:E2p8L90ysTTUkU5FUOgGoCQ7ucEUgqJ/tvYgiGGAlEM= github.com/refraction-networking/utls v1.8.2 h1:j4Q1gJj0xngdeH+Ox/qND11aEfhpgoEvV+S9iJ2IdQo= github.com/refraction-networking/utls v1.8.2/go.mod h1:jkSOEkLqn+S/jtpEHPOsVv/4V4EVnelwbMQl4vCWXAM= github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= From 675b1a9c58c57dbedb7227dd69f99471eccb7550 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 09:45:16 +0000 Subject: [PATCH 25/32] chore(deps): bump the external group across 1 directory with 5 updates Bumps the external group with 4 updates in the / directory: [github.com/go-faker/faker/v4](https://github.com/go-faker/faker), [github.com/stretchr/testify](https://github.com/stretchr/testify), [golang.org/x/net](https://github.com/golang/net) and [github.com/happyhackingspace/dit](https://github.com/happyhackingspace/dit). Updates `github.com/go-faker/faker/v4` from 4.10.0 to 4.11.0 - [Release notes](https://github.com/go-faker/faker/releases) - [Commits](https://github.com/go-faker/faker/compare/v4.10.0...v4.11.0) Updates `github.com/stretchr/testify` from 1.11.1 to 1.12.1 - [Release notes](https://github.com/stretchr/testify/releases) - [Commits](https://github.com/stretchr/testify/compare/v1.11.1...v1.12.1) Updates `golang.org/x/net` from 0.57.0 to 0.58.0 - [Commits](https://github.com/golang/net/compare/v0.57.0...v0.58.0) Updates `golang.org/x/text` from 0.40.0 to 0.41.0 - [Release notes](https://github.com/golang/text/releases) - [Commits](https://github.com/golang/text/compare/v0.40.0...v0.41.0) Updates `github.com/happyhackingspace/dit` from 0.0.31 to 0.0.32 - [Release notes](https://github.com/happyhackingspace/dit/releases) - [Commits](https://github.com/happyhackingspace/dit/compare/v0.0.31...v0.0.32) --- updated-dependencies: - dependency-name: github.com/go-faker/faker/v4 dependency-version: 4.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: external - dependency-name: github.com/happyhackingspace/dit dependency-version: 0.0.32 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: external - dependency-name: github.com/stretchr/testify dependency-version: 1.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: external - dependency-name: golang.org/x/net dependency-version: 0.58.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: external - dependency-name: golang.org/x/text dependency-version: 0.41.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: external ... Signed-off-by: dependabot[bot] --- go.mod | 19 +++++++++---------- go.sum | 36 ++++++++++++++++++------------------ 2 files changed, 27 insertions(+), 28 deletions(-) diff --git a/go.mod b/go.mod index ba966212a..7be9fdc26 100644 --- a/go.mod +++ b/go.mod @@ -7,7 +7,7 @@ require ( github.com/PuerkitoBio/goquery v1.12.0 github.com/akrylysov/pogreb v0.10.2 // indirect github.com/corona10/goimagehash v1.1.0 - github.com/go-faker/faker/v4 v4.10.0 + github.com/go-faker/faker/v4 v4.11.0 github.com/go-rod/rod v0.116.2 github.com/golang/snappy v0.0.4 // indirect github.com/hbakhtiyor/strsim v0.0.0-20190107154042-4d2bbb273edf @@ -39,14 +39,14 @@ require ( github.com/projectdiscovery/wappalyzergo v0.2.94 github.com/rs/xid v1.6.0 github.com/spaolacci/murmur3 v1.1.0 - github.com/stretchr/testify v1.11.1 + github.com/stretchr/testify v1.12.1 github.com/zmap/zcrypto v0.0.0-20240803002437-3a861682ac77 go.etcd.io/bbolt v1.4.0 // indirect go.uber.org/multierr v1.11.0 golang.org/x/exp v0.0.0-20260112195511-716be5621a96 - golang.org/x/net v0.57.0 + golang.org/x/net v0.58.0 golang.org/x/sys v0.47.0 // indirect - golang.org/x/text v0.40.0 + golang.org/x/text v0.41.0 ) require ( @@ -55,7 +55,7 @@ require ( github.com/go-sql-driver/mysql v1.10.0 github.com/go-viper/mapstructure/v2 v2.5.0 github.com/gocarina/gocsv v0.0.0-20240520201108-78e41c74b4b1 - github.com/happyhackingspace/dit v0.0.31 + github.com/happyhackingspace/dit v0.0.32 github.com/lib/pq v1.12.3 github.com/projectdiscovery/awesome-search-queries v0.0.0-20260104120501-961ef30f7193 github.com/seh-msft/burpxml v1.0.1 @@ -83,7 +83,6 @@ require ( github.com/cheggaaa/pb/v3 v3.1.6 // indirect github.com/cloudflare/cfssl v1.6.4 // indirect github.com/cnf/structhash v0.0.0-20250313080605-df4c6cc74a9a // indirect - github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect github.com/dimchansky/utfbom v1.1.1 // indirect github.com/djherbis/times v1.6.0 // indirect github.com/dlclark/regexp2 v1.11.5 // indirect @@ -122,7 +121,6 @@ require ( github.com/muesli/reflow v0.3.0 // indirect github.com/muesli/termenv v0.16.0 // indirect github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646 // indirect - github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect github.com/projectdiscovery/blackrock v0.0.2 // indirect github.com/projectdiscovery/freeport v0.0.7 // indirect @@ -163,12 +161,13 @@ require ( github.com/yusufpapurcu/wmi v1.2.4 // indirect github.com/zcalusic/sysinfo v1.0.2 // indirect github.com/zmap/rc2 v0.0.0-20190804163417-abaa70531248 // indirect - golang.org/x/crypto v0.54.0 // indirect - golang.org/x/mod v0.37.0 // indirect + go.yaml.in/yaml/v3 v3.0.5 // indirect + golang.org/x/crypto v0.55.0 // indirect + golang.org/x/mod v0.38.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect golang.org/x/sync v0.22.0 // indirect golang.org/x/term v0.45.0 // indirect golang.org/x/time v0.15.0 // indirect - golang.org/x/tools v0.47.0 // indirect + golang.org/x/tools v0.48.0 // indirect gopkg.in/ini.v1 v1.67.0 // indirect ) diff --git a/go.sum b/go.sum index 6f4ab46b4..fd88badb0 100644 --- a/go.sum +++ b/go.sum @@ -98,8 +98,8 @@ github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4 github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw= github.com/gaissmai/bart v0.29.0 h1:wO6HGE8g9YE0Wm0bCpYxwRzfQ4+fbJKOhL64e5ACGCI= github.com/gaissmai/bart v0.29.0/go.mod h1:GREWQfTLRWz/c5FTOsIw+KkscuFkIV5t8Rp7Nd1Td5c= -github.com/go-faker/faker/v4 v4.10.0 h1:rHTZVwG1x8aN4zXDYJUFucOGDQojuxOby5MTdC/M2Fw= -github.com/go-faker/faker/v4 v4.10.0/go.mod h1:X+KzPB4JZ82GY4MYr7NV7zmp+i/K0SG5EDKqIg5zd1k= +github.com/go-faker/faker/v4 v4.11.0 h1:HeIFTzafXsgrlxKE2QySGGTQocfGdQ8sGqU2CXvs120= +github.com/go-faker/faker/v4 v4.11.0/go.mod h1:VFIEwWDd16EdYDLF6NJ5gAAzEp7vz5LgKgJ2iZ17Tdg= github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY= github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0= github.com/go-rod/rod v0.116.2 h1:A5t2Ky2A+5eD/ZJQr1EfsQSe5rms5Xof/qj296e+ZqA= @@ -153,8 +153,8 @@ github.com/gosimple/slug v1.15.0 h1:wRZHsRrRcs6b0XnxMUBM6WK1U1Vg5B0R7VkIf1Xzobo= github.com/gosimple/slug v1.15.0/go.mod h1:UiRaFH+GEilHstLUmcBgWcI42viBN7mAb818JrYOeFQ= github.com/gosimple/unidecode v1.0.1 h1:hZzFTMMqSswvf0LBJZCZgThIZrpDHFXux9KeGmn6T/o= github.com/gosimple/unidecode v1.0.1/go.mod h1:CP0Cr1Y1kogOtx0bJblKzsVWrqYaqfNOnHzpgWw4Awc= -github.com/happyhackingspace/dit v0.0.31 h1:E9HGMpWMEDRH+SvKPAGjTiKDZIZ4x6uHrn/PkwkGRv4= -github.com/happyhackingspace/dit v0.0.31/go.mod h1:xrqwz6vKxSDPQ9I1uOcK/mNEBFoZ1xY4ok3BRBhq+Sw= +github.com/happyhackingspace/dit v0.0.32 h1:cnkiF4OnTPpJOPjuaxl4xcLdB0UalJgStwqpevdyrqM= +github.com/happyhackingspace/dit v0.0.32/go.mod h1:xrqwz6vKxSDPQ9I1uOcK/mNEBFoZ1xY4ok3BRBhq+Sw= github.com/hashicorp/go-version v1.9.0 h1:CeOIz6k+LoN3qX9Z0tyQrPtiB1DFYRPfCIBtaXPSCnA= github.com/hashicorp/go-version v1.9.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA= github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k= @@ -244,8 +244,6 @@ github.com/orisano/pixelmatch v0.0.0-20220722002657-fb0b55479cde/go.mod h1:nZgzb github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= -github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= -github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 h1:o4JXh1EVt9k/+g42oCprj/FisM4qX9L3sZB3upGN2ZU= github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE= github.com/projectdiscovery/asnmap v1.1.1 h1:ImJiKIaACOT7HPx4Pabb5dksolzaFYsD1kID2iwsDqI= @@ -336,8 +334,8 @@ github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81P github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= -github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= -github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= +github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= +github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= github.com/syndtr/goleveldb v1.0.0 h1:fBdIW9lB4Iz0n9khmH8w27SJ3QEJ7+IgjPEwGSZiFdE= github.com/syndtr/goleveldb v1.0.0/go.mod h1:ZVVdQEZoIme9iO1Ch2Jdy24qqXrMMOU6lpPAyBWyWuQ= github.com/tidwall/assert v0.1.0 h1:aWcKyRBUAdLoVebxo95N7+YZVTFF/ASTr7BN4sLP6XI= @@ -426,6 +424,8 @@ go.mongodb.org/mongo-driver v1.17.9 h1:IexDdCuuNJ3BHrELgBlyaH9p60JXAvdzWR128q+U5 go.mongodb.org/mongo-driver v1.17.9/go.mod h1:LlOhpH5NUEfhxcAwG0UEkMqwYcc4JU18gtCdGudk/tQ= go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0= go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y= +go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= +go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= @@ -440,8 +440,8 @@ golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDf golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8= golang.org/x/crypto v0.25.0/go.mod h1:T+wALwcMOSE0kXgUAnPAHqTLW+XHgcELELW8VaDgm/M= golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk= -golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw= -golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk= +golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M= +golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis= golang.org/x/exp v0.0.0-20260112195511-716be5621a96 h1:Z/6YuSHTLOHfNFdb8zVZomZr7cqNgTJvA8+Qz75D8gU= golang.org/x/exp v0.0.0-20260112195511-716be5621a96/go.mod h1:nzimsREAkjBCIEFtHiYkrJyT+2uy9YZJB7H1k68CXZU= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= @@ -449,8 +449,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c= golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c= -golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ= -golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0= +golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk= +golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40= golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= @@ -469,8 +469,8 @@ golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44= golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM= golang.org/x/net v0.27.0/go.mod h1:dDi0PyhWNoiUOrAS8uXv/vnScO4wnHQO4mj9fn/RytE= golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4= -golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= -golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU= +golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= +golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.6.0/go.mod h1:ycmewcwgD4Rpr3eZJLSB4Kyyljb3qDh40vJ8STE5HKw= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= @@ -543,8 +543,8 @@ golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI= golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ= -golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs= -golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY= +golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8= +golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M= golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= @@ -553,8 +553,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58= golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk= -golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q= -golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA= +golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE= +golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM= From 2f8ce2516ee518d30e7034a3b0240d9a00e98eb4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Do=C4=9Fan=20Can=20Bak=C4=B1r?= Date: Tue, 11 Aug 2026 17:27:06 -0700 Subject: [PATCH 26/32] feat: add -kb to make page type classification opt-in Closes #2543 --- README.md | 1 + runner/options.go | 21 +++++++++++++++++++++ runner/runner.go | 9 +++++++-- 3 files changed, 29 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 5d18f63b6..298c87333 100644 --- a/README.md +++ b/README.md @@ -113,6 +113,7 @@ PROBES: -server, -web-server display server name -td, -tech-detect display technology in use based on wappalyzer dataset -cff, -custom-fingerprint-file string path to a custom fingerprint file for technology detection + -kb, -knowledge-base enable knowledge base classification -method display http request method -ws, -websocket display server using websocket -ip display host ip diff --git a/runner/options.go b/runner/options.go index a23760286..f636b9d16 100644 --- a/runner/options.go +++ b/runner/options.go @@ -204,6 +204,9 @@ type Options struct { // Deprecated: use OutputFilterPageType with "error" instead. OutputFilterErrorPage bool OutputFilterPageType goflags.StringSlice + // KnowledgeBase enables knowledge base classification using dit. It is + // implied by OutputFilterPageType/OutputFilterErrorPage, which need it. + KnowledgeBase bool FilterOutDuplicates bool OutputFilterContentLength string InputRawRequest string @@ -412,6 +415,7 @@ func ParseOptions() *Options { flagSet.StringVarP(&options.CustomFingerprintFile, "custom-fingerprint-file", "cff", "", "path to a custom fingerprint file for technology detection"), flagSet.BoolVar(&options.CPEDetect, "cpe", false, "display CPE (Common Platform Enumeration) with product version based on awesome-search-queries"), flagSet.BoolVarP(&options.WordPress, "wordpress", "wp", false, "display WordPress plugins and themes"), + flagSet.BoolVarP(&options.KnowledgeBase, "knowledge-base", "kb", false, "enable knowledge base classification"), flagSet.BoolVar(&options.OutputMethod, "method", false, "display http request method"), flagSet.BoolVarP(&options.OutputWebSocket, "websocket", "ws", false, "display server using websocket"), flagSet.BoolVar(&options.OutputIP, "ip", false, "display host ip"), @@ -720,6 +724,19 @@ func (options *Options) HasMatcherOrFilter() bool { options.OutputFilterResponseTime != "" } +// hasPageTypeFilter reports whether a filter that depends on the page type +// classification is in use. +func (options *Options) hasPageTypeFilter() bool { + return len(options.OutputFilterPageType) > 0 || options.OutputFilterErrorPage +} + +// classificationEnabled reports whether the knowledge base classifier should be +// loaded. It is opt-in via -kb, and implied by the page type filters that +// cannot work without it. +func (options *Options) classificationEnabled() bool { + return options.KnowledgeBase || options.hasPageTypeFilter() +} + func (options *Options) ValidateOptions() error { if options.InputFile != "" && !fileutilz.FileNameIsGlob(options.InputFile) && !fileutil.FileExists(options.InputFile) { return fmt.Errorf("file '%s' does not exist", options.InputFile) @@ -917,6 +934,10 @@ func (options *Options) configureOutput() { gologger.Info().Msg("-fep is deprecated, use -fpt error instead") options.OutputFilterPageType = goflags.StringSlice{"error"} } + // page type filters cannot work without the classifier + if options.hasPageTypeFilter() { + options.KnowledgeBase = true + } } func (options *Options) configureResume() error { diff --git a/runner/runner.go b/runner/runner.go index eed5d886b..888f06826 100644 --- a/runner/runner.go +++ b/runner/runner.go @@ -431,10 +431,15 @@ func New(options *Options) (*Runner, error) { } runner.simHashes = gcache.New[uint64, []string](1000).ARC().Build() - if options.JSONOutput || options.CSVOutput || len(options.OutputFilterPageType) > 0 { + if options.classificationEnabled() { ditClassifier, err := dit.New() if err != nil { - gologger.Warning().Msgf("Could not initialize page classifier: %s", err) + // without a classifier the page type filters silently pass + // everything through, so a failure is fatal when one is in use + if options.hasPageTypeFilter() { + return nil, errors.Wrap(err, "could not initialize page classifier") + } + gologger.Error().Msgf("Could not initialize page classifier: %s", err) } runner.ditClassifier = ditClassifier } From 1be236411d5bb36eb81738a89789c2d46a1c5289 Mon Sep 17 00:00:00 2001 From: Mzack9999 Date: Mon, 24 Aug 2026 14:28:59 +0400 Subject: [PATCH 27/32] fail classifier --- runner/runner.go | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/runner/runner.go b/runner/runner.go index 888f06826..63dccb05d 100644 --- a/runner/runner.go +++ b/runner/runner.go @@ -434,12 +434,7 @@ func New(options *Options) (*Runner, error) { if options.classificationEnabled() { ditClassifier, err := dit.New() if err != nil { - // without a classifier the page type filters silently pass - // everything through, so a failure is fatal when one is in use - if options.hasPageTypeFilter() { - return nil, errors.Wrap(err, "could not initialize page classifier") - } - gologger.Error().Msgf("Could not initialize page classifier: %s", err) + return nil, errors.Wrap(err, "could not initialize page classifier") } runner.ditClassifier = ditClassifier } From c8d240c4bb64c181965155276ab8d5a85ccbc6c5 Mon Sep 17 00:00:00 2001 From: Mzack9999 Date: Mon, 24 Aug 2026 15:04:47 +0400 Subject: [PATCH 28/32] fix leaks --- common/httpx/filter_test.go | 18 ++++++ common/httpx/pipeline.go | 2 +- common/httpx/pipeline_test.go | 51 +++++++++++++++ internal/pdcp/writer.go | 33 ++++++---- internal/pdcp/writer_test.go | 116 ++++++++++++++++++++++++++++++++++ 5 files changed, 205 insertions(+), 15 deletions(-) create mode 100644 common/httpx/pipeline_test.go create mode 100644 internal/pdcp/writer_test.go diff --git a/common/httpx/filter_test.go b/common/httpx/filter_test.go index 9a163183a..8c96e43a4 100644 --- a/common/httpx/filter_test.go +++ b/common/httpx/filter_test.go @@ -42,6 +42,24 @@ func TestFilterCustomErrorPropagation(t *testing.T) { require.NoError(t, err) }) + t.Run("error stops remaining callbacks", func(t *testing.T) { + called := 0 + filter := FilterCustom{CallBacks: []CustomCallback{ + func(*Response) (bool, error) { + called++ + return false, errors.New("fail") + }, + func(*Response) (bool, error) { + called++ + return true, nil + }, + }} + ok, err := filter.Filter(&Response{}) + require.False(t, ok) + require.Error(t, err) + require.Equal(t, 1, called) + }) + t.Run("no callbacks match returns false with nil error", func(t *testing.T) { callbacks := []CustomCallback{ func(response *Response) (bool, error) { return false, nil }, diff --git a/common/httpx/pipeline.go b/common/httpx/pipeline.go index d804833f5..e1f4b0188 100644 --- a/common/httpx/pipeline.go +++ b/common/httpx/pipeline.go @@ -29,7 +29,7 @@ func (h *HTTPX) SupportPipeline(protocol, method, host string, port int) bool { if err != nil { return false } - defer conn.Close() + defer func() { _ = conn.Close() }() // send some probes nprobes := 10 for i := 0; i < nprobes; i++ { diff --git a/common/httpx/pipeline_test.go b/common/httpx/pipeline_test.go new file mode 100644 index 000000000..01eb683ff --- /dev/null +++ b/common/httpx/pipeline_test.go @@ -0,0 +1,51 @@ +package httpx + +import ( + "io" + "net" + "strconv" + "testing" + "time" + + "github.com/stretchr/testify/require" +) + +func TestSupportPipelineClosesConn(t *testing.T) { + ln, err := net.Listen("tcp", "127.0.0.1:0") + require.NoError(t, err) + defer func() { _ = ln.Close() }() + + _, portStr, err := net.SplitHostPort(ln.Addr().String()) + require.NoError(t, err) + port, err := strconv.Atoi(portStr) + require.NoError(t, err) + + closed := make(chan struct{}) + go func() { + conn, err := ln.Accept() + if err != nil { + return + } + defer func() { _ = conn.Close() }() + buf := make([]byte, 64*1024) + _ = conn.SetReadDeadline(time.Now().Add(2 * time.Second)) + _, _ = conn.Read(buf) + _, _ = conn.Write([]byte("HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\nHTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\n")) + _, _ = io.Copy(io.Discard, conn) + close(closed) + }() + + h := &HTTPX{} + _ = h.SupportPipeline("http", "GET", "127.0.0.1", port) + + select { + case <-closed: + case <-time.After(3 * time.Second): + t.Fatal("pipeline probe connection was not closed") + } +} + +func TestSupportPipelineDialError(t *testing.T) { + h := &HTTPX{} + require.False(t, h.SupportPipeline("http", "GET", "127.0.0.1", 1)) +} diff --git a/internal/pdcp/writer.go b/internal/pdcp/writer.go index 06ee03999..ba5eb54f3 100644 --- a/internal/pdcp/writer.go +++ b/internal/pdcp/writer.go @@ -131,6 +131,7 @@ func (u *UploadWriter) autoCommit(ctx context.Context) { // temporary buffer to store the results buff := &bytes.Buffer{} ticker := time.NewTicker(flushTimer) + defer ticker.Stop() for { select { @@ -169,18 +170,13 @@ func (u *UploadWriter) autoCommit(ctx context.Context) { } u.counter.Add(1) line := conversion.String(lineBytes) - if buff.Len()+len(line) > MaxChunkSize { - // flush existing buffer - if err := u.uploadChunk(buff); err != nil { + appendResultLine(buff, line, MaxChunkSize, func(b *bytes.Buffer) error { + if err := u.uploadChunk(b); err != nil { gologger.Error().Msgf("Failed to upload asset results on cloud: %v", err) + return err } - // write the current line to the now-empty buffer so it is not lost - buff.WriteString(line) - buff.WriteString("\n") - } else { - buff.WriteString(line) - buff.WriteString("\n") - } + return nil + }) } } } @@ -262,12 +258,21 @@ func (u *UploadWriter) getRequest(bin []byte) (*retryablehttp.Request, error) { return req, nil } +// appendResultLine writes line to buff, flushing existing data first when the +// next write would exceed max. An empty buffer is never flushed, so a single +// oversized line is retained instead of dropped or uploaded as an empty chunk. +func appendResultLine(buff *bytes.Buffer, line string, max int, flush func(*bytes.Buffer) error) { + if buff.Len() > 0 && buff.Len()+len(line) > max { + _ = flush(buff) + } + buff.WriteString(line) + buff.WriteString("\n") +} + // Close closes the upload writer func (u *UploadWriter) Close() { - // atomically ensure we only close the channel once - if !u.closed.CompareAndSwap(false, true) { - return + if u.closed.CompareAndSwap(false, true) { + close(u.data) } - close(u.data) <-u.done } diff --git a/internal/pdcp/writer_test.go b/internal/pdcp/writer_test.go new file mode 100644 index 000000000..4122a6352 --- /dev/null +++ b/internal/pdcp/writer_test.go @@ -0,0 +1,116 @@ +package pdcp + +import ( + "bytes" + "errors" + "sync" + "testing" + "time" + + "github.com/projectdiscovery/httpx/runner" + "github.com/stretchr/testify/require" +) + +func TestAppendResultLine(t *testing.T) { + t.Run("keeps lines under the limit without flushing", func(t *testing.T) { + buff := &bytes.Buffer{} + flushed := 0 + appendResultLine(buff, "ab", 10, func(*bytes.Buffer) error { + flushed++ + return nil + }) + appendResultLine(buff, "cd", 10, func(*bytes.Buffer) error { + flushed++ + return nil + }) + require.Equal(t, 0, flushed) + require.Equal(t, "ab\ncd\n", buff.String()) + }) + + t.Run("flushes existing data and keeps the overflowing line", func(t *testing.T) { + buff := &bytes.Buffer{} + flush := func(b *bytes.Buffer) error { + require.Equal(t, "aaaa\n", b.String()) + b.Reset() + return nil + } + appendResultLine(buff, "aaaa", 6, flush) + appendResultLine(buff, "bbbb", 6, flush) + require.Equal(t, "bbbb\n", buff.String()) + }) + + t.Run("does not flush an empty buffer for an oversized line", func(t *testing.T) { + buff := &bytes.Buffer{} + flushed := 0 + appendResultLine(buff, "toolong", 4, func(*bytes.Buffer) error { + flushed++ + return nil + }) + require.Equal(t, 0, flushed) + require.Equal(t, "toolong\n", buff.String()) + }) + + t.Run("still appends the current line when flush fails", func(t *testing.T) { + buff := bytes.NewBufferString("old\n") + appendResultLine(buff, "new", 4, func(*bytes.Buffer) error { + return errors.New("upload failed") + }) + require.Equal(t, "old\nnew\n", buff.String()) + }) +} + +func TestUploadWriterCloseWaits(t *testing.T) { + u := &UploadWriter{ + done: make(chan struct{}, 1), + data: make(chan runner.Result, 8), + } + + started := make(chan struct{}) + release := make(chan struct{}) + go func() { + for range u.data { + } + close(started) + <-release + u.done <- struct{}{} + close(u.done) + }() + + firstDone := make(chan struct{}) + go func() { + u.Close() + close(firstDone) + }() + + select { + case <-started: + case <-time.After(2 * time.Second): + t.Fatal("Close did not close the data channel") + } + + secondDone := make(chan struct{}) + go func() { + u.Close() + close(secondDone) + }() + + select { + case <-secondDone: + t.Fatal("second Close returned before autoCommit finished") + case <-time.After(50 * time.Millisecond): + } + + close(release) + + var wg sync.WaitGroup + wg.Add(2) + go func() { defer wg.Done(); <-firstDone }() + go func() { defer wg.Done(); <-secondDone }() + done := make(chan struct{}) + go func() { wg.Wait(); close(done) }() + select { + case <-done: + case <-time.After(2 * time.Second): + t.Fatal("Close hung") + } +} From 8a6eaaa239387c75f5f9382cf1223f27148ac375 Mon Sep 17 00:00:00 2001 From: Mzack9999 Date: Mon, 24 Aug 2026 17:32:55 +0400 Subject: [PATCH 29/32] count newline --- internal/pdcp/writer.go | 9 +++++---- internal/pdcp/writer_test.go | 15 +++++++++++++++ 2 files changed, 20 insertions(+), 4 deletions(-) diff --git a/internal/pdcp/writer.go b/internal/pdcp/writer.go index ba5eb54f3..d397b06d6 100644 --- a/internal/pdcp/writer.go +++ b/internal/pdcp/writer.go @@ -258,11 +258,12 @@ func (u *UploadWriter) getRequest(bin []byte) (*retryablehttp.Request, error) { return req, nil } -// appendResultLine writes line to buff, flushing existing data first when the -// next write would exceed max. An empty buffer is never flushed, so a single -// oversized line is retained instead of dropped or uploaded as an empty chunk. +// appendResultLine writes line and its trailing newline to buff, flushing +// existing data first when the next write would exceed max. An empty buffer is +// never flushed, so a single oversized line is retained instead of dropped or +// uploaded as an empty chunk. func appendResultLine(buff *bytes.Buffer, line string, max int, flush func(*bytes.Buffer) error) { - if buff.Len() > 0 && buff.Len()+len(line) > max { + if buff.Len() > 0 && buff.Len()+len(line)+len("\n") > max { _ = flush(buff) } buff.WriteString(line) diff --git a/internal/pdcp/writer_test.go b/internal/pdcp/writer_test.go index 4122a6352..a877eac6d 100644 --- a/internal/pdcp/writer_test.go +++ b/internal/pdcp/writer_test.go @@ -50,6 +50,21 @@ func TestAppendResultLine(t *testing.T) { require.Equal(t, "toolong\n", buff.String()) }) + t.Run("newline counts towards the limit", func(t *testing.T) { + buff := &bytes.Buffer{} + const max = 6 + flush := func(b *bytes.Buffer) error { + b.Reset() + return nil + } + // "abc\n" is 4 bytes, appending "de\n" would reach 7 without counting + // the newline in the check. + appendResultLine(buff, "abc", max, flush) + appendResultLine(buff, "de", max, flush) + require.LessOrEqual(t, buff.Len(), max) + require.Equal(t, "de\n", buff.String()) + }) + t.Run("still appends the current line when flush fails", func(t *testing.T) { buff := bytes.NewBufferString("old\n") appendResultLine(buff, "new", 4, func(*bytes.Buffer) error { From 62168a9a9c27bb922584b650e322393aa0ba9e44 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Do=C4=9Fan=20Can=20Bak=C4=B1r?= Date: Wed, 26 Aug 2026 05:20:09 +0300 Subject: [PATCH 30/32] bump version to v1.11.0 --- runner/banner.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/runner/banner.go b/runner/banner.go index d127cdba2..3f021e8c7 100644 --- a/runner/banner.go +++ b/runner/banner.go @@ -16,7 +16,7 @@ const banner = ` ` // Version is the current Version of httpx -const Version = `v1.10.0` +const Version = `v1.11.0` // showBanner is used to show the banner to the user func showBanner() { From 534d8bb14c126a43d9237f3dace94b54560bf465 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 27 Aug 2026 22:53:57 +0400 Subject: [PATCH 31/32] chore(deps): bump the projectdiscovery group with 4 updates (#2566) Bumps the projectdiscovery group with 4 updates: [github.com/projectdiscovery/cdncheck](https://github.com/projectdiscovery/cdncheck), [github.com/projectdiscovery/fastdialer](https://github.com/projectdiscovery/fastdialer), [github.com/projectdiscovery/networkpolicy](https://github.com/projectdiscovery/networkpolicy) and [github.com/projectdiscovery/wappalyzergo](https://github.com/projectdiscovery/wappalyzergo). Updates `github.com/projectdiscovery/cdncheck` from 1.2.49 to 1.2.50 - [Release notes](https://github.com/projectdiscovery/cdncheck/releases) - [Commits](https://github.com/projectdiscovery/cdncheck/compare/v1.2.49...v1.2.50) Updates `github.com/projectdiscovery/fastdialer` from 0.5.16 to 0.5.17 - [Release notes](https://github.com/projectdiscovery/fastdialer/releases) - [Commits](https://github.com/projectdiscovery/fastdialer/compare/v0.5.16...v0.5.17) Updates `github.com/projectdiscovery/networkpolicy` from 0.1.45 to 0.1.46 - [Release notes](https://github.com/projectdiscovery/networkpolicy/releases) - [Commits](https://github.com/projectdiscovery/networkpolicy/compare/v0.1.45...v0.1.46) Updates `github.com/projectdiscovery/wappalyzergo` from 0.2.94 to 0.2.95 - [Release notes](https://github.com/projectdiscovery/wappalyzergo/releases) - [Commits](https://github.com/projectdiscovery/wappalyzergo/compare/v0.2.94...v0.2.95) --- updated-dependencies: - dependency-name: github.com/projectdiscovery/cdncheck dependency-version: 1.2.50 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: projectdiscovery - dependency-name: github.com/projectdiscovery/fastdialer dependency-version: 0.5.17 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: projectdiscovery - dependency-name: github.com/projectdiscovery/networkpolicy dependency-version: 0.1.46 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: projectdiscovery - dependency-name: github.com/projectdiscovery/wappalyzergo dependency-version: 0.2.95 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: projectdiscovery ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 8 ++++---- go.sum | 16 ++++++++-------- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/go.mod b/go.mod index 7be9fdc26..cf0ab8c69 100644 --- a/go.mod +++ b/go.mod @@ -19,24 +19,24 @@ require ( github.com/miekg/dns v1.1.72 // indirect github.com/pkg/errors v0.9.1 github.com/projectdiscovery/asnmap v1.1.1 - github.com/projectdiscovery/cdncheck v1.2.49 + github.com/projectdiscovery/cdncheck v1.2.50 github.com/projectdiscovery/clistats v0.1.5 github.com/projectdiscovery/dsl v0.8.21 - github.com/projectdiscovery/fastdialer v0.5.16 + github.com/projectdiscovery/fastdialer v0.5.17 github.com/projectdiscovery/fdmax v0.0.4 github.com/projectdiscovery/goconfig v0.0.1 github.com/projectdiscovery/goflags v0.1.76 github.com/projectdiscovery/gologger v1.1.72 github.com/projectdiscovery/hmap v0.0.101 github.com/projectdiscovery/mapcidr v1.1.97 - github.com/projectdiscovery/networkpolicy v0.1.45 + github.com/projectdiscovery/networkpolicy v0.1.46 github.com/projectdiscovery/ratelimit v0.0.88 github.com/projectdiscovery/rawhttp v0.1.91 github.com/projectdiscovery/retryablehttp-go v1.3.23 github.com/projectdiscovery/tlsx v1.3.2 github.com/projectdiscovery/useragent v0.0.108 github.com/projectdiscovery/utils v0.11.1 - github.com/projectdiscovery/wappalyzergo v0.2.94 + github.com/projectdiscovery/wappalyzergo v0.2.95 github.com/rs/xid v1.6.0 github.com/spaolacci/murmur3 v1.1.0 github.com/stretchr/testify v1.12.1 diff --git a/go.sum b/go.sum index fd88badb0..35d28dac9 100644 --- a/go.sum +++ b/go.sum @@ -252,14 +252,14 @@ github.com/projectdiscovery/awesome-search-queries v0.0.0-20260104120501-961ef30 github.com/projectdiscovery/awesome-search-queries v0.0.0-20260104120501-961ef30f7193/go.mod h1:nSovPcipgSx/EzAefF+iCfORolkKAuodiRWL3RCGHOM= github.com/projectdiscovery/blackrock v0.0.2 h1:mxXdu0uM8P2L2Qi210COlU8QiICPFW/Rxk5QUhlPO2k= github.com/projectdiscovery/blackrock v0.0.2/go.mod h1:ANUtjDfaVrqB453bzToU+YB4cUbvBRpLvEwoWIwlTss= -github.com/projectdiscovery/cdncheck v1.2.49 h1:f1k74Nvwo44gbOmKPh132J/EcrX0uKGTJJD+acVlzFY= -github.com/projectdiscovery/cdncheck v1.2.49/go.mod h1:9oE9KKxCSHNvUf0UaMeqqUwWpC38FkNaTll0ScIBT3w= +github.com/projectdiscovery/cdncheck v1.2.50 h1:KZBYT4jKNvlmlDKJqGMJ7r6XtwAim82oEZLaI+NAWWk= +github.com/projectdiscovery/cdncheck v1.2.50/go.mod h1:9oE9KKxCSHNvUf0UaMeqqUwWpC38FkNaTll0ScIBT3w= github.com/projectdiscovery/clistats v0.1.5 h1:kHhRWZGTrXUBzKAnZ7sY1G15JIA+DuzxopN1k5SxaOg= github.com/projectdiscovery/clistats v0.1.5/go.mod h1:hjJYNcUubk9T3cuFvA+JkLhZGjzYW50fkC48dqUAtbU= github.com/projectdiscovery/dsl v0.8.21 h1:LXz0T5AjWyIyTbmsjdjutnucaRPMein1gVdoxwtJxZY= github.com/projectdiscovery/dsl v0.8.21/go.mod h1:AX4IYLANTX7vFyBm7szaFwtdLr3awAlGpSp3cYIYBPM= -github.com/projectdiscovery/fastdialer v0.5.16 h1:cds7enBT8YFDjGuBVJu7K0J2H0KVnPIrwFf3gJCSkLY= -github.com/projectdiscovery/fastdialer v0.5.16/go.mod h1:+eYcmH0Fp6IhHtnr/FeFyjg1jT7efcFT/O8WcvTMsX4= +github.com/projectdiscovery/fastdialer v0.5.17 h1:XnTT9ERQ66S7sqRkXFLSDsyxGz6Eh3Y9VPpDJPRBsTo= +github.com/projectdiscovery/fastdialer v0.5.17/go.mod h1:2pO3BcUJdvCUBOzxVLQN7vpTP3ycQ4S+gPeFyYBJAkk= github.com/projectdiscovery/fdmax v0.0.4 h1:K9tIl5MUZrEMzjvwn/G4drsHms2aufTn1xUdeVcmhmc= github.com/projectdiscovery/fdmax v0.0.4/go.mod h1:oZLqbhMuJ5FmcoaalOm31B1P4Vka/CqP50nWjgtSz+I= github.com/projectdiscovery/freeport v0.0.7 h1:Q6uXo/j8SaV/GlAHkEYQi8WQoPXyJWxyspx+aFmz9Qk= @@ -280,8 +280,8 @@ github.com/projectdiscovery/machineid v0.0.0-20250715113114-c77eb3567582 h1:eR+0 github.com/projectdiscovery/machineid v0.0.0-20250715113114-c77eb3567582/go.mod h1:3G3BRKui7nMuDFAZKR/M2hiOLtaOmyukT20g88qRQjI= github.com/projectdiscovery/mapcidr v1.1.97 h1:7FkxNNVXp+m1rIu5Nv/2SrF9k4+LwP8QuWs2puwy+2w= github.com/projectdiscovery/mapcidr v1.1.97/go.mod h1:9dgTJh1SP02gYZdpzMjm6vtYFkEHQHoTyaVNvaeJ7lA= -github.com/projectdiscovery/networkpolicy v0.1.45 h1:Hg3j9XiMC2MAJs1r5ydIJzGVfPxGS++FAM6VdRPPOR0= -github.com/projectdiscovery/networkpolicy v0.1.45/go.mod h1:q1KeQiHchXdElScEMWc5mShWNRNoJXI5koRnVaX6Qh8= +github.com/projectdiscovery/networkpolicy v0.1.46 h1:lZblKcIQh8Kd0/JA5AxspxgjNz4ffs2NEf/KxMtXV1g= +github.com/projectdiscovery/networkpolicy v0.1.46/go.mod h1:q1KeQiHchXdElScEMWc5mShWNRNoJXI5koRnVaX6Qh8= github.com/projectdiscovery/ratelimit v0.0.88 h1:AcurW9aLRzlEyPe9kSjnOpr3XzLMWTpiWAlW/w73ALU= github.com/projectdiscovery/ratelimit v0.0.88/go.mod h1:CU1s+68UUG2mctSl2wi32/DHLJA6TMg+4rxgP59LfVk= github.com/projectdiscovery/rawhttp v0.1.91 h1:6EIhZxCkBn27kJAl47FieCFCe4H2ZdbhoBVj0J6ZCVY= @@ -298,8 +298,8 @@ github.com/projectdiscovery/useragent v0.0.108 h1:fb+uLuFJvC+MHZjCtxQJxtvp1X6A8n github.com/projectdiscovery/useragent v0.0.108/go.mod h1:XdNRrlvtDmYfVL1Oybat4uMe+W6cLwsK9S18ond17CI= github.com/projectdiscovery/utils v0.11.1 h1:PWj1KjIASxt8icxommH72C0TQqNOvGkcSODRkiq0SQw= github.com/projectdiscovery/utils v0.11.1/go.mod h1:yktGrHGk2CTjNiccXovnvGrLHX9sV2bqz9nSnbA3V8M= -github.com/projectdiscovery/wappalyzergo v0.2.94 h1:uHyNIb5OFLzyvEd6v64JLoc7Dlg3dBSjlPyjCIz0+T8= -github.com/projectdiscovery/wappalyzergo v0.2.94/go.mod h1:E2p8L90ysTTUkU5FUOgGoCQ7ucEUgqJ/tvYgiGGAlEM= +github.com/projectdiscovery/wappalyzergo v0.2.95 h1:XHjbQVrrxusezFq7ciWmtznPKWhpr/srWp7Yk2noxqg= +github.com/projectdiscovery/wappalyzergo v0.2.95/go.mod h1:E2p8L90ysTTUkU5FUOgGoCQ7ucEUgqJ/tvYgiGGAlEM= github.com/refraction-networking/utls v1.8.2 h1:j4Q1gJj0xngdeH+Ox/qND11aEfhpgoEvV+S9iJ2IdQo= github.com/refraction-networking/utls v1.8.2/go.mod h1:jkSOEkLqn+S/jtpEHPOsVv/4V4EVnelwbMQl4vCWXAM= github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= From b614009352389e3d2df890c5afd72a971bafa09c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 27 Aug 2026 22:54:25 +0400 Subject: [PATCH 32/32] chore(deps): bump github.com/happyhackingspace/dit from 0.0.32 to 0.0.33 in the external group (#2567) chore(deps): bump github.com/happyhackingspace/dit in the external group Bumps the external group with 1 update: [github.com/happyhackingspace/dit](https://github.com/happyhackingspace/dit). Updates `github.com/happyhackingspace/dit` from 0.0.32 to 0.0.33 - [Release notes](https://github.com/happyhackingspace/dit/releases) - [Commits](https://github.com/happyhackingspace/dit/compare/v0.0.32...v0.0.33) --- updated-dependencies: - dependency-name: github.com/happyhackingspace/dit dependency-version: 0.0.33 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: external ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index cf0ab8c69..b677c8abb 100644 --- a/go.mod +++ b/go.mod @@ -55,7 +55,7 @@ require ( github.com/go-sql-driver/mysql v1.10.0 github.com/go-viper/mapstructure/v2 v2.5.0 github.com/gocarina/gocsv v0.0.0-20240520201108-78e41c74b4b1 - github.com/happyhackingspace/dit v0.0.32 + github.com/happyhackingspace/dit v0.0.33 github.com/lib/pq v1.12.3 github.com/projectdiscovery/awesome-search-queries v0.0.0-20260104120501-961ef30f7193 github.com/seh-msft/burpxml v1.0.1 diff --git a/go.sum b/go.sum index 35d28dac9..037d6823e 100644 --- a/go.sum +++ b/go.sum @@ -153,8 +153,8 @@ github.com/gosimple/slug v1.15.0 h1:wRZHsRrRcs6b0XnxMUBM6WK1U1Vg5B0R7VkIf1Xzobo= github.com/gosimple/slug v1.15.0/go.mod h1:UiRaFH+GEilHstLUmcBgWcI42viBN7mAb818JrYOeFQ= github.com/gosimple/unidecode v1.0.1 h1:hZzFTMMqSswvf0LBJZCZgThIZrpDHFXux9KeGmn6T/o= github.com/gosimple/unidecode v1.0.1/go.mod h1:CP0Cr1Y1kogOtx0bJblKzsVWrqYaqfNOnHzpgWw4Awc= -github.com/happyhackingspace/dit v0.0.32 h1:cnkiF4OnTPpJOPjuaxl4xcLdB0UalJgStwqpevdyrqM= -github.com/happyhackingspace/dit v0.0.32/go.mod h1:xrqwz6vKxSDPQ9I1uOcK/mNEBFoZ1xY4ok3BRBhq+Sw= +github.com/happyhackingspace/dit v0.0.33 h1:54W6qwYz4UtlFuhAMWY5KoctYdBBjDjU/Fx9teLyWxo= +github.com/happyhackingspace/dit v0.0.33/go.mod h1:MjkhMq79Zn7LmBRa+2LErpmYZzP0BdHrGaAZa8ftO+o= github.com/hashicorp/go-version v1.9.0 h1:CeOIz6k+LoN3qX9Z0tyQrPtiB1DFYRPfCIBtaXPSCnA= github.com/hashicorp/go-version v1.9.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA= github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=