The active-testing climb: a full battery of injection, access-control, and misconfiguration scanners, plus the offensive-expansion identification modules (service→CVE, ScopeGuard, TLS inspection, fingerprint, HTTP methods, subdomain takeover, exposure, cache deception) — each with adversarial review, a regression test, and built-in false-positive guards. Plus a tool-wide HTTP client correctness fix.
- add Hidden parameter mining, IDOR/BOLA (API #1), mass-assignment (API #6), and active CORS exploitability — the API-security battery.
- add JS recon. Mines same-origin bundles for API endpoints (real attack surface, including unlinked routes) and flags exposed source maps that leak original source.
- add Race-condition tester. Fires N synchronized concurrent copies and flags a limited-use operation that leaked extra successes — distinguishing a real race from rate-limiting / overload.
- add Verb-tampering auth bypass. Retries a denied request with alternate methods / override headers and flags any that flip to 2xx serving real content.
- fix HTTP client no longer hangs on HEAD / 204 / 304 responses, correctly skips 1xx interim responses, and handles stacked Transfer-Encoding — across every active-testing feature.
- add One-command deep audit.
nullock audit <url> runs the whole battery against an endpoint; audit all sweeps every URL you give it plus every captured request — findings stream into the panel as they're confirmed.
- add GraphQL schema analysis.
nullock graphql schema <url> pulls the introspection schema and flags dangerous mutations (deleteUser, grantAdmin, …) and sensitive fields (password, apiKey, ssn) by camelCase/snake-boundary match — distinguishing a WAF/error page from genuinely-disabled introspection.
- add Server-side template injection.
nullock ssti <url> <param> injects a sentinel-bracketed arithmetic polyglot per engine family (Jinja2, Freemarker, ERB, Smarty, Razor, …) and confirms RCE-class SSTI when the server renders the product — immune to coincidental digits and locale number-grouping, and it fingerprints the engine. Burp Community has no SSTI check at all.
- add Web cache poisoning.
nullock cachepoison <url> reflects unkeyed headers (X-Forwarded-Host, X-Original-URL, …) behind a cache-buster and proves the poison end to end — a clean, header-less request served the sentinel from cache. It verifies the buster is part of the cache key first and refuses to inject otherwise, so a live run can't poison the response real users are served.
- add Open redirect scanner.
nullock openredirect <url> [param] fires a parser-confusion battery (scheme-relative, backslash, userinfo @, whitelist-prefix, missing-slash) and confirms only when the resolved Location host leaves the origin — no false positives from same-origin reflections, and it auto-detects the redirect param.
- add The one-command deep audit now runs the full active battery — open-redirect, web-cache-poisoning, and per-parameter SSTI joined param-mining, IDOR, mass-assignment, CORS, and verb-tampering.
nullock audit <url> and audit all surface every class in one pass.
- add CSP & security-header auditor.
nullock headeraudit <url> goes past "has a CSP" — it flags unsafe-inline that isn't neutralized by a nonce/hash, wildcard/scheme sources, missing object-src/base-uri, and allow-listed script-gadget hosts (Google APIs, common CDNs) an attacker can run script through — plus HSTS, nosniff, clickjacking, Referrer-Policy, and cookie-flag checks, following same-origin redirects to audit the real page.
- add Client-side secret scanner.
nullock secrets <url> fetches the page and its same-origin bundles and flags leaked credentials — AWS/Google/Stripe/GitHub/Slack/SendGrid keys, private-key blocks, and entropy-gated assigned secrets — every match masked so the finding locates the leak without re-exposing it. truffleHog-class coverage, in-line.
- add CRLF / response-splitting detection.
nullock crlf <url> [param] injects encoded-CRLF payloads carrying a uniquely-named marker header and confirms the bug only when that header actually appears in the parsed response — a real split, never a reflection false positive.
- add Path traversal / LFI.
nullock lfi <url> [param] fires a battery of traversal encodings (../, %2e%2e%2f, ....//, double-encoded, backslash) at /etc/passwd and win.ini and confirms by the file's content fingerprint — a line-anchored, multi-field signature that a prose mention can't trip — with a bounded request budget.
- add OS command injection.
nullock cmdi <url> [param] chains echo $((a*b)) through every separator (; | && $() backtick, newline) inside random sentinels and confirms RCE only when the shell returns the evaluated product — exact-match, no timing, no reflection false positives.
- add Reflected XSS.
nullock xss <url> [param] injects a random-marker tag and confirms only when the response is HTML, the angle brackets reflect unencoded, and the reflection lands in executable element content — a tiny HTML context scanner rules out JSON responses, comments, raw-text elements, and attribute values, so it doesn't cry wolf on every reflecting search box.
- add SQL injection (error-based + blind time-based).
nullock sqli <url> [param] injects syntax-breaking quotes and confirms only when a DBMS error surfaces that the baseline lacked and a balanced quote clears it — fingerprinting MySQL / PostgreSQL / MSSQL / Oracle / SQLite. Add blind for time-based detection: a SLEEP(5) that delays while the same-shape SLEEP(0) stays fast (and the delay reproduces) — the majority of real SQLi, which shows no error at all.
- add XXE (XML external entity).
nullock xxe <url> POSTs an XML body whose external entity targets a local file and confirms by that file's content signature in the response — and since the signature is remote file content (never in the request), an echo endpoint can't false-positive it.
- add NoSQL injection.
nullock nosqli <url> [param] tests the MongoDB-style operator class (param[$ne]= → auth bypass) with a literal/$ne/$eq differential gated on a two-shot stability baseline — so dynamic pages, type-confusion error paths, and non-Mongo apps don't trip it.
- add ScopeGuard. Every active test, scan, audit, chain, intruder, repeater, and authz replay now refuses hosts the project marks out of scope — one authorization gate so a malicious local page can't pivot through Nullock to attack arbitrary hosts, and an operator can't accidentally hit a target they aren't authorized for. No change when no scope is set; it bites once in/out-of-scope rules exist.
- add Web cache deception.
nullock cachedeception <url> detects the path-confusion precondition — a dynamic/sensitive page also served at a static-extension URL (/account/x.css) a cache would store per-user — distinct from the cache-poisoning check, and higher-severity when the response is cacheable.
- add Sensitive-file exposure scan.
nullock exposure <url> probes high-value paths — .git/config, .env, phpinfo.php, server-status, Spring Actuator /env, config backups, AWS creds, .DS_Store — and confirms each by a content signature, so a server that 200s everything doesn't false-positive.
- add One-call host assessment.
nullock assess <url> runs the safe identification battery in a single pass — tech fingerprint (+CVE correlation), security-header/CSP audit, HTTP-method audit, and (for https) TLS inspection — and returns the aggregated, severity-bucketed findings. Point it at a host, get a report; the active injection battery stays opt-in via audit.
- add Subdomain-takeover detection.
nullock takeover <host> matches a curated table of dangling-service fingerprints (GitHub Pages, S3, Heroku, Azure, Fastly, Shopify, Pantheon, Ghost, Read the Docs…) to flag a subdomain whose DNS points at an unclaimed service — the classic bug-bounty takeover, identification-only.
- add HTTP method audit.
nullock methods <url> reads the OPTIONS Allow header and flags dangerous write methods (PUT/DELETE/PATCH) and WebDAV, plus a non-mutating TRACE echo probe for Cross-Site Tracing. Read-only — it never actively PUTs/DELETEs.
- add Active tech fingerprint.
nullock fingerprint <url> identifies the stack on demand — server, CMS, language, framework, JS libraries with versions from headers, cookies, and body/meta markers (WhatWeb/Wappalyzer class) — and auto-correlates versioned detections against the CVE database.
- add TLS / certificate inspection.
nullock tls <host> [port] reads the peer certificate and negotiated protocol/cipher and flags weak config — expired, not-yet-valid, self-signed, sub-2048-bit key, hostname/SAN mismatch, soon-to-expire — plus deprecated TLS 1.0/1.1 that still handshake. testssl.sh-class, read-only.
- add Service-version CVE matching.
nullock vulnscan <host> banner-grabs network services (SSH/FTP/SMTP/HTTP/…) and flags vulnerable versions against a curated CVE table — vsftpd 2.3.4 backdoor, OpenSSH regreSSHion, Apache 2.4.49/.50 path traversal, ProFTPd mod_copy, Exim RCE, IIS WebDAV, SambaCry — each with CVE id, CVSS, and fix version. The nmap-vulners capability, wired to the port scanner. Read-only: it identifies vulnerable versions, it does not exploit them.
- add HTTP request smuggling.
nullock smuggle <url> times CL.TE and TE.CL desync probes and flags the variant whose response is reproducibly delayed — Burp Pro's flagship, free. A valid-but-ambiguous control request rules out servers that merely tarpit ambiguous input, and the probes carry Connection: close so they can't smuggle into a real user's request.