|
| 1 | +# Changelog |
| 2 | + |
| 3 | +All notable changes to Project Lethe are documented here. The format is based on |
| 4 | +[Keep a Changelog](https://keepachangelog.com/), and the project aims to follow |
| 5 | +[Semantic Versioning](https://semver.org/). Dates are omitted where unknown. |
| 6 | + |
| 7 | +## [Unreleased] |
| 8 | + |
| 9 | +### Fixed |
| 10 | +- **Payloads were double-encoded on the wire (critical).** The `test`/`discover` |
| 11 | + query and form-body injection used `urlencode`, which re-encoded `%` in |
| 12 | + already-encoded payloads (e.g. `%3Cscript%3E` became `%253Cscript%253E`). |
| 13 | + The application then never saw the decoded payload, silently neutralizing the |
| 14 | + URL-encoding family of techniques. Payloads now reach the wire verbatim, with |
| 15 | + only request-invalid characters (controls, space, DEL, non-ASCII) percent-encoded. |
| 16 | +- **Scope port over-permissiveness.** A port-specific allow rule |
| 17 | + (`example.com:8443`) wrongly matched a default-port URL (`https://example.com/`). |
| 18 | + The URL's implicit port is now resolved from its scheme (https=443, http=80) so |
| 19 | + port-scoped rules match exactly; portless rules still match any port. |
| 20 | +- Same wire-encoding fix applied to the mutation proxy's request rewriting. |
| 21 | + |
| 22 | +## [0.15.0] |
| 23 | + |
| 24 | +### Added |
| 25 | +- **HTTPS interception for the mutation proxy** (`proxy --https`) via a local CA |
| 26 | + that mints per-host leaf certificates on demand. Optional `[mitm]` extra |
| 27 | + (`cryptography`); core stays dependency-free. Upstream TLS is still verified. |
| 28 | + |
| 29 | +### Changed |
| 30 | +- Split `cli.py`: extracted config coercion helpers into `cli_config.py` and the |
| 31 | + output formatters into `cli_render.py`, with no behavioral change. |
| 32 | + |
| 33 | +## [0.14.0] |
| 34 | + |
| 35 | +### Added |
| 36 | +- `http-run`: execute HTTP/1.1 discrepancy templates over raw sockets against an |
| 37 | + authorized target (HTTP/2 templates remain text-only and are skipped). |
| 38 | +- `schema`: ingest OpenAPI/Swagger or GraphQL introspection and recommend |
| 39 | + type-aware profiles, contexts, and technique tags per parameter. |
| 40 | +- `proxy`: scope-gated HTTP mutation middleware that mutates live traffic in place. |
| 41 | +- Export generated variants as Nuclei templates or Burp BCheck scripts |
| 42 | + (`generate --format nuclei|bcheck`). |
| 43 | +- Vendor-tuned profiles (`cloudflare`, `akamai`, `aws_waf`, `imperva`, |
| 44 | + `modsecurity`, `f5`) that `fingerprint` recommends automatically. |
| 45 | +- Path/header normalization mutators: `path_empty_segment`, `path_dot_segment`, |
| 46 | + `semicolon_url_encode`. |
| 47 | +- `generate --output` to write variants to a file (parity with other commands). |
| 48 | + |
| 49 | +### Fixed |
| 50 | +- BOM-tolerant reading of user-provided files (schema, feeds, site profile, |
| 51 | + request file, HAR) so Windows-emitted UTF-8 BOMs no longer break parsing. |
| 52 | +- Clarified `_waf_header_signal` logic (no behavioral change). |
| 53 | + |
| 54 | +## [0.13.0] |
| 55 | + |
| 56 | +### Added |
| 57 | +- **Oracle-guided `discover` engine**: evolves technique chains against a target, |
| 58 | + keeps survivors, flags novel bypasses, and delta-debug-minimizes them. |
| 59 | +- **n-day knowledge feeds** (`feeds`): an inert, versioned pack mapping bypass |
| 60 | + classes to profiles/techniques, surfaced automatically during `fingerprint`. |
| 61 | +- **Per-engine and advanced techniques**: MySQL/MSSQL/Postgres SQLi profiles, |
| 62 | + SSTI and shell profiles, SQL keyword comment insertion, IPv4 decimal/octal/hex |
| 63 | + encodings, and shell separator/quote mutators. |
| 64 | +- **Trustworthy verdicts**: per-target oracle calibration, multi-sample baselines, |
| 65 | + and automatic bypass re-confirmation. |
| 66 | +- **Reflection-context detection**: labels where a payload landed (HTML body, |
| 67 | + attribute, script, JSON, ...) and flags `likely_exploitable`. |
| 68 | +- New `STYX://PROJECT-LETHE` "canonicalization resolve" banner animation. |
| 69 | + |
| 70 | +### Changed |
| 71 | +- Cross-platform CI matrix (Linux/macOS/Windows x 3.10-3.13), ruff + mypy gates, |
| 72 | + `noxfile.py`, Dockerfile, and packaging metadata. Fixed the Windows-only test |
| 73 | + failures (temp-file handling and POSIX file-mode assumptions). |
| 74 | + |
| 75 | +## [0.12.0] |
| 76 | + |
| 77 | +### Added |
| 78 | +- **Active testing core.** `test` command that injects generated variants at an |
| 79 | + authorized target and classifies each response (blocked, passed, rate-limited, |
| 80 | + challenged, origin error, inconclusive) with confidence and signals. |
| 81 | +- **Default-deny scope guard** (hosts, wildcards, ports, CIDRs; flags, file, or |
| 82 | + config) enforced before any traffic is sent. |
| 83 | +- **WAF/CDN fingerprinting** with technique suggestions. |
| 84 | +- Concurrency, rate limiting, and proxy pass-through (`--proxy`). |
| 85 | +- **Context-aware mutators** (`--context`) and a charset/normalization engine: |
| 86 | + NFKC compatibility homoglyphs, overlong UTF-8, and inconsistent partial encoding. |
| 87 | +- Request import from `curl`, raw HTTP, or HAR (`--curl`/`--request-file`/`--har`, |
| 88 | + with the `§INJECT§` marker). |
| 89 | +- Local SQLite session store and `history`, integrity-hashed run manifests, and |
| 90 | + versioned (`schema_version`) JSON output with documented exit codes. |
| 91 | + |
| 92 | +## [0.11.0] |
| 93 | + |
| 94 | +- Initial baseline: deterministic payload mutation engine, context profiles, |
| 95 | + `explain`/`analyze`, single-request site profiling, HTTP discrepancy templates, |
| 96 | + auth memory, and the AI safety planner/report layer. |
0 commit comments