// changelog

What shipped

Every release, newest first. Versions follow semver. Dates are when the build went out.

v3.7.0 Jul 5, 2026 latest

The academy + platform-completion release: the full 50-lab Web Security Academy clone, the OWASP injection family completed, out-of-band auto-confirmation, and deployable standalone OAST + team-sync servers. Each feature shipped with an adversarial review and a regression test.

  • add 50-lab Web Security Academy clone. labs/01labs/50, each a single-file intentionally-vulnerable app mapped to a Nullock probe (XSS, SQLi, SSRF, XXE, IDOR, OAuth, GraphQL, deserialization, cache poisoning/deception, and more), verified end-to-end against its detector.
  • add OWASP injection family completed. LDAP + XPath injection (error-based with safe-value corroboration), first-class fetch-proven SSRF (cloud-metadata / file:// / internal, with encoding-bypass denylist), insecure deserialization (Java/PHP/Python/Ruby/.NET), active JWT attacks (alg:none / not-verified / weak-secret / RS256→HS256), cross-site WebSocket hijacking, host-header injection, and server-side prototype pollution.
  • add OAST out-of-band auto-confirmation. nullock oast blast sprays blind SSRF / OS-command-injection / XXE / Log4Shell payloads; a callback to the in-process HTTP or DNS sink auto-confirms the class via the correlator — a true-positive no response echo can give.
  • add Standalone deployable servers. nullock-oast (public callback sink) and nullock-workspace (team findings-sync, SQLite + bearer-key auth, identity-key merge), both Dockerized with deploy guides.
  • add Recon + discovery. Certificate transparency (crt.sh) in nullock recon, soft-404-calibrated content/directory discovery, CSRF-PoC generator, and copy-as-curl.
  • fix CVE database + enricher accuracy. Web-verified every CVE entry against NVD/vendor advisories (corrected ~11 over-broad/mis-scored entries, removed 3 bogus); every emitted finding kind now enriches to CWE/OWASP via family-prefix fallbacks.
v3.6.0 Jun 17, 2026

The platform release. The scanner grew a network layer and a full reporting + recon suite: a port-scan→findings bridge, a point-at-a-host recon→vuln pipeline, WAF/CDN and robots/sitemap recon, a live CVE-feed overlay, and engagement reporting (HTML with an A–F grade, JSON bundle, CycloneDX SBOM, OWASP/compliance coverage, asset inventory, posture grade, baseline diff). Each feature shipped with a multi-lens adversarial review and a regression test.

  • add WAF / CDN detection. nullock waf <url> identifies the protective infrastructure fronting a target — Cloudflare, Akamai, Imperva, AWS WAF/CloudFront, F5 BIG-IP, Fastly, Sucuri, NetScaler, FortiWeb, Reblaze, PerimeterX, DataDome, Vercel, Netlify, BunnyCDN, … (30+ vendors) — from response header/cookie signatures (wafw00f-class). Passive: it reads what the infra announces, sends no attack payload. Recon context Burp doesn't surface.
  • add robots.txt / sitemap recon. nullock robots <url> pulls /robots.txt and /sitemap.xml and surfaces the Disallow paths — the unlinked admin/backup/internal endpoints owners hide from crawlers — as recon findings, plus the sitemap URL set. Hidden attack surface, in one call.
  • add JSON master report. nullock report json emits one machine-readable bundle for CI / dashboards — posture grade, OWASP + compliance coverage, host inventory, and the full findings list, all from the same shared computations as the dedicated endpoints (so the numbers always agree).
  • add Report leads with the grade. The HTML engagement report now opens with the A–F security-posture badge (shared scoring with nullock posture, so they can't disagree) — the one-glance verdict above the severity breakdown and findings.
  • add More service-version CVEs. The banner→CVE matcher gained OpenSSH ssh-agent RCE (CVE-2023-38408), Apache mod_proxy request smuggling (CVE-2023-25690), and Apache mod_lua overflow (CVE-2021-44790) — version-range matched, with patched builds correctly excluded.
  • add More web-app CVE coverage. The fingerprint→CVE database gained Joomla (CVE-2023-23752 unauth config disclosure, CVE-2015-8562 object-injection RCE) and PHP (CVE-2024-4577 PHP-CGI argument-injection RCE) — the PHP entry split per maintained branch so a patched build isn't false-flagged.
  • fix Server CVEs now correlate. The curated Apache/HTTP-server CVEs (mod_proxy SSRF CVE-2024-38473, HTTP/2 Rapid Reset CVE-2023-44487) were filed under a kind nothing looked up — re-keyed to the server-apache/server-nginx the fingerprinter emits, with clean version pins, so a fingerprinted Server version actually flags them (and nginx Rapid Reset is now covered too).
  • add Live CVE feed sync. nullock cvefeed sync <url> (or load <file.json> for air-gapped) extends the service-version CVE matcher at runtime — overlay entries match by product + version range alongside the curated table, so detection coverage grows without a rebuild. The CVE feed Burp gates behind add-ons.
  • add OWASP & compliance coverage. nullock compliance rolls findings into a coverage matrix — grouped by OWASP Top-10 2021 category (all ten, with counts and which were hit) and by compliance tag (PCI-DSS, …). The audit/compliance reporting view Burp gates behind Enterprise.
  • add Security posture grade. nullock posture rolls all findings into one executive number — a letter grade (A–F) and 0–100 score, severity-weighted, with the breakdown and the top risks. The "how bad is it, in one glance" summary for the report header / dashboard.
  • add Findings baseline & diff. nullock baseline save snapshots the current findings; nullock baseline diff compares a later run against it and reports what's new (regressions), fixed (resolved), and unchanged. The repeat-engagement / re-test delta that Burp Pro lacks — persisted to the project so it survives restarts.
  • add CycloneDX SBOM export. nullock export sbom emits a CycloneDX 1.5 software bill of materials — components from detected technologies, vulnerabilities from correlated CVEs (with CVSS ratings and NVD links), each linked to its component. A supply-chain / compliance artifact (feeds Dependency-Track, etc.) that Burp doesn't produce.
  • add Asset inventory. nullock inventory rolls everything up into one record per host — open ports/services, detected technologies, and finding counts (by severity, with max CVSS and top severity) — sorted by risk. The "what do I actually know about each host" view that ties the network scan and the web findings together.
  • add HTML engagement report. nullock report html produces a self-contained, styled report — executive summary, severity breakdown (cards + stacked bar), and a per-finding table with CWE/OWASP/CVSS/remediation — that opens standalone in any browser. Every server/target-derived value is HTML-escaped, so the report can't become an XSS vector when you open it. (Markdown export via report build stays too.)
  • add Recon → vuln pipeline. nullock pipeline [host] is the point-at-a-host capstone: it bridges the port-scan results into network findings (exposed services + CVEs), then runs the safe web-identification battery — tech fingerprint (+CVE), security-header/CSP audit, HTTP-method audit, TLS inspection — against every open HTTP/HTTPS port discovered, and aggregates both layers into one severity-bucketed report. Scope-gated (out-of-scope hosts are skipped, not probed), idempotent across both layers, and web ports are classified so it won't fire HTTP probes at a confirmed non-HTTP service.
  • add Scan → findings bridge. nullock scan-findings turns the port scanner's results into first-class findings — exposed databases (MySQL/Postgres/Mongo/Redis/Elastic…), remote-admin (RDP/VNC/Telnet), management APIs (Docker/etcd/Kubernetes/Consul/Webmin), file shares (SMB/NFS), and cleartext protocols — plus banner→CVE correlation, so the network layer rides into the same findings list, report, SARIF export, and CWE/OWASP enrichment as every web finding. Pure transform: no extra packets (the scan was already scope-gated), idempotent on re-run, and severity is calibrated to each finding's CVSS.
  • fix The engagement report builder (/api/report/build) and the grouped-findings view returned zero findings due to an off-by-one in the "return all" code path — both now include the full finding set.
v3.5.0 Jun 11, 2026

The active-testing climb: a full battery of injection, access-control, and misconfiguration scanners, plus the offensive-expansion identification modules (service→CVE, ScopeGuard, TLS inspection, fingerprint, HTTP methods, subdomain takeover, exposure, cache deception) — each with adversarial review, a regression test, and built-in false-positive guards. Plus a tool-wide HTTP client correctness fix.

  • add Hidden parameter mining, IDOR/BOLA (API #1), mass-assignment (API #6), and active CORS exploitability — the API-security battery.
  • add JS recon. Mines same-origin bundles for API endpoints (real attack surface, including unlinked routes) and flags exposed source maps that leak original source.
  • add Race-condition tester. Fires N synchronized concurrent copies and flags a limited-use operation that leaked extra successes — distinguishing a real race from rate-limiting / overload.
  • add Verb-tampering auth bypass. Retries a denied request with alternate methods / override headers and flags any that flip to 2xx serving real content.
  • fix HTTP client no longer hangs on HEAD / 204 / 304 responses, correctly skips 1xx interim responses, and handles stacked Transfer-Encoding — across every active-testing feature.
  • add One-command deep audit. nullock audit <url> runs the whole battery against an endpoint; audit all sweeps every URL you give it plus every captured request — findings stream into the panel as they're confirmed.
  • add GraphQL schema analysis. nullock graphql schema <url> pulls the introspection schema and flags dangerous mutations (deleteUser, grantAdmin, …) and sensitive fields (password, apiKey, ssn) by camelCase/snake-boundary match — distinguishing a WAF/error page from genuinely-disabled introspection.
  • add Server-side template injection. nullock ssti <url> <param> injects a sentinel-bracketed arithmetic polyglot per engine family (Jinja2, Freemarker, ERB, Smarty, Razor, …) and confirms RCE-class SSTI when the server renders the product — immune to coincidental digits and locale number-grouping, and it fingerprints the engine. Burp Community has no SSTI check at all.
  • add Web cache poisoning. nullock cachepoison <url> reflects unkeyed headers (X-Forwarded-Host, X-Original-URL, …) behind a cache-buster and proves the poison end to end — a clean, header-less request served the sentinel from cache. It verifies the buster is part of the cache key first and refuses to inject otherwise, so a live run can't poison the response real users are served.
  • add Open redirect scanner. nullock openredirect <url> [param] fires a parser-confusion battery (scheme-relative, backslash, userinfo @, whitelist-prefix, missing-slash) and confirms only when the resolved Location host leaves the origin — no false positives from same-origin reflections, and it auto-detects the redirect param.
  • add The one-command deep audit now runs the full active battery — open-redirect, web-cache-poisoning, and per-parameter SSTI joined param-mining, IDOR, mass-assignment, CORS, and verb-tampering. nullock audit <url> and audit all surface every class in one pass.
  • add CSP & security-header auditor. nullock headeraudit <url> goes past "has a CSP" — it flags unsafe-inline that isn't neutralized by a nonce/hash, wildcard/scheme sources, missing object-src/base-uri, and allow-listed script-gadget hosts (Google APIs, common CDNs) an attacker can run script through — plus HSTS, nosniff, clickjacking, Referrer-Policy, and cookie-flag checks, following same-origin redirects to audit the real page.
  • add Client-side secret scanner. nullock secrets <url> fetches the page and its same-origin bundles and flags leaked credentials — AWS/Google/Stripe/GitHub/Slack/SendGrid keys, private-key blocks, and entropy-gated assigned secrets — every match masked so the finding locates the leak without re-exposing it. truffleHog-class coverage, in-line.
  • add CRLF / response-splitting detection. nullock crlf <url> [param] injects encoded-CRLF payloads carrying a uniquely-named marker header and confirms the bug only when that header actually appears in the parsed response — a real split, never a reflection false positive.
  • add Path traversal / LFI. nullock lfi <url> [param] fires a battery of traversal encodings (../, %2e%2e%2f, ....//, double-encoded, backslash) at /etc/passwd and win.ini and confirms by the file's content fingerprint — a line-anchored, multi-field signature that a prose mention can't trip — with a bounded request budget.
  • add OS command injection. nullock cmdi <url> [param] chains echo $((a*b)) through every separator (; | && $() backtick, newline) inside random sentinels and confirms RCE only when the shell returns the evaluated product — exact-match, no timing, no reflection false positives.
  • add Reflected XSS. nullock xss <url> [param] injects a random-marker tag and confirms only when the response is HTML, the angle brackets reflect unencoded, and the reflection lands in executable element content — a tiny HTML context scanner rules out JSON responses, comments, raw-text elements, and attribute values, so it doesn't cry wolf on every reflecting search box.
  • add SQL injection (error-based + blind time-based). nullock sqli <url> [param] injects syntax-breaking quotes and confirms only when a DBMS error surfaces that the baseline lacked and a balanced quote clears it — fingerprinting MySQL / PostgreSQL / MSSQL / Oracle / SQLite. Add blind for time-based detection: a SLEEP(5) that delays while the same-shape SLEEP(0) stays fast (and the delay reproduces) — the majority of real SQLi, which shows no error at all.
  • add XXE (XML external entity). nullock xxe <url> POSTs an XML body whose external entity targets a local file and confirms by that file's content signature in the response — and since the signature is remote file content (never in the request), an echo endpoint can't false-positive it.
  • add NoSQL injection. nullock nosqli <url> [param] tests the MongoDB-style operator class (param[$ne]= → auth bypass) with a literal/$ne/$eq differential gated on a two-shot stability baseline — so dynamic pages, type-confusion error paths, and non-Mongo apps don't trip it.
  • add ScopeGuard. Every active test, scan, audit, chain, intruder, repeater, and authz replay now refuses hosts the project marks out of scope — one authorization gate so a malicious local page can't pivot through Nullock to attack arbitrary hosts, and an operator can't accidentally hit a target they aren't authorized for. No change when no scope is set; it bites once in/out-of-scope rules exist.
  • add Web cache deception. nullock cachedeception <url> detects the path-confusion precondition — a dynamic/sensitive page also served at a static-extension URL (/account/x.css) a cache would store per-user — distinct from the cache-poisoning check, and higher-severity when the response is cacheable.
  • add Sensitive-file exposure scan. nullock exposure <url> probes high-value paths — .git/config, .env, phpinfo.php, server-status, Spring Actuator /env, config backups, AWS creds, .DS_Store — and confirms each by a content signature, so a server that 200s everything doesn't false-positive.
  • add One-call host assessment. nullock assess <url> runs the safe identification battery in a single pass — tech fingerprint (+CVE correlation), security-header/CSP audit, HTTP-method audit, and (for https) TLS inspection — and returns the aggregated, severity-bucketed findings. Point it at a host, get a report; the active injection battery stays opt-in via audit.
  • add Subdomain-takeover detection. nullock takeover <host> matches a curated table of dangling-service fingerprints (GitHub Pages, S3, Heroku, Azure, Fastly, Shopify, Pantheon, Ghost, Read the Docs…) to flag a subdomain whose DNS points at an unclaimed service — the classic bug-bounty takeover, identification-only.
  • add HTTP method audit. nullock methods <url> reads the OPTIONS Allow header and flags dangerous write methods (PUT/DELETE/PATCH) and WebDAV, plus a non-mutating TRACE echo probe for Cross-Site Tracing. Read-only — it never actively PUTs/DELETEs.
  • add Active tech fingerprint. nullock fingerprint <url> identifies the stack on demand — server, CMS, language, framework, JS libraries with versions from headers, cookies, and body/meta markers (WhatWeb/Wappalyzer class) — and auto-correlates versioned detections against the CVE database.
  • add TLS / certificate inspection. nullock tls <host> [port] reads the peer certificate and negotiated protocol/cipher and flags weak config — expired, not-yet-valid, self-signed, sub-2048-bit key, hostname/SAN mismatch, soon-to-expire — plus deprecated TLS 1.0/1.1 that still handshake. testssl.sh-class, read-only.
  • add Service-version CVE matching. nullock vulnscan <host> banner-grabs network services (SSH/FTP/SMTP/HTTP/…) and flags vulnerable versions against a curated CVE table — vsftpd 2.3.4 backdoor, OpenSSH regreSSHion, Apache 2.4.49/.50 path traversal, ProFTPd mod_copy, Exim RCE, IIS WebDAV, SambaCry — each with CVE id, CVSS, and fix version. The nmap-vulners capability, wired to the port scanner. Read-only: it identifies vulnerable versions, it does not exploit them.
  • add HTTP request smuggling. nullock smuggle <url> times CL.TE and TE.CL desync probes and flags the variant whose response is reproducibly delayed — Burp Pro's flagship, free. A valid-but-ambiguous control request rules out servers that merely tarpit ambiguous input, and the probes carry Connection: close so they can't smuggle into a real user's request.
v3.4.0 Jun 11, 2026

Active testing & API-security release. Five scanners that find real, exploitable bugs the free tools can't — each shipped with adversarial code review and a regression test, each with built-in false-positive guards.

  • add OAST auto-correlation + active OOB blast + DNS sink. Out-of-band callbacks become confirmed findings automatically; nullock oast blast sprays SSRF/XXE/Log4Shell, and a DNS sink catches the name-only callbacks an HTTP sink can't.
  • add Hidden parameter mining. Response-diffs a candidate wordlist to find undocumented params (reflected or status-flipping), with a control probe that suppresses targets reacting to any param.
  • add IDOR / BOLA auto-detection (OWASP API #1). Replays neighboring object ids under your session and flags distinct accessible objects — robust to per-request tokens via calibrated length comparison.
  • add Mass-assignment scanner (OWASP API #6). Injects privileged fields (role, is_admin, balance…) into write requests and reports the ones the server binds back.
  • add Active CORS exploitability. Fires an Origin battery and proves credentialed cross-origin reads — not just a passive header note.
v3.3.0 Jun 9, 2026

The "above the paid tools" release. Five capabilities that commercial scanners gate behind add-ons or don't ship at all — now in the free core, each with regression coverage.

  • add CVE correlation. Fingerprinted frameworks (WordPress, Drupal, Magento, Spring, Next.js, …) are matched against a curated CVE table; every hit becomes a finding tagged with CVE id, CVSS, and fix version.
  • add GraphQL attack probes. One call fires five probes — introspection, field-suggestion leak, alias amplification, depth bypass, batched-query bypass — with false-positive guards. nullock graphql <url>.
  • add DOM-XSS taint analysis. A proxy-side extension does one-hop dataflow on every served script, connecting sources (location, referrer, postMessage, storage) to sinks (innerHTML, eval, document.write) and attributing the true origin.
  • add Repeater chains. Define a sequence of requests, extract values (JSON path / header / cookie / regex / status) from each response, and thread them as {{var}} into later steps. nullock chain <file>.
  • add JWT attack toolkit. Decode + weakness analysis (alg:none, missing/expired exp, kid injection, privilege claims), weak-secret brute-force, and forging (alg:none + HS256 re-sign). Passive auto-analysis on captured tokens too.
  • add OAST auto-correlation. Callbacks no longer just sit in a log — a registered token arriving out-of-band auto-emits a confirmed finding linked to the originating request. The half of Collaborator worth paying for, self-hosted and free.
  • add Active OOB blast. nullock oast blast <url> sprays SSRF (a battery of param names), blind XXE, and Log4Shell payloads; each callback confirms tagged by attack class.
  • add DNS OAST sink. Catches the OOB classes the HTTP sink can't — Log4Shell JNDI resolution, blind-SQLi DNS exfil, DNS-only SSRF — feeding the same correlator. --oast-host / --dns-port for real-target deploys.
  • add Every finding now carries CWE, OWASP Top-10 2021, CVSS v3.1, and a one-line fix — across all of the above.
v3.2.0 Jun 2, 2026
  • add Repeater now diffs two responses side by side, with byte-level highlighting.
  • add nullock export --json streams scoped history without loading it all into memory.
  • fix History scroll no longer jumps when new rows arrive while a row is selected.
  • perf SQLite write batching cut capture overhead by ~40% at 200k rows.
v3.1.4 May 18, 2026
  • fix CA install on Linux now writes to /usr/local/share/ca-certificates correctly under Wayland.
  • fix Match & replace rules with empty bodies no longer drop the connection.
  • add nullock vacuum to compact history files after big sessions.
v3.1.0 Apr 29, 2026
  • add JavaScript extensions — hook the request/response pipeline, drop a .js in the ext dir.
  • change Scope syntax now accepts glob patterns, e.g. *.app.local.
  • fix Memory leak when streaming large (>50 MB) responses.
v3.0.0 Mar 11, 2026

Rewrote the capture core in C++ / Qt. The desktop app is now a thin front end over the same binary you can script.

  • add Native desktop app for macOS, Linux, Windows.
  • add SQLite-backed history — 200k+ rows on a 16 GB box.
  • change Config moved to ~/.nullock/. A migration runs on first launch.
  • remove Dropped the legacy Electron build. It was slow and we don't miss it.