Conversation
Add unit tests for pure/helper functions in: - internal/db/shared.go (marshalPhaseJSON, unmarshalPhaseJSON) - internal/scanner/aem (NormalizeURL, ContentType, BasicAuth, RandomString) - internal/scanner/dsieve (rootDomain, FilterTopSubdomains, FilterSubdomainsByRoots) - internal/scanner/ffuf (LogFilter.Write) - internal/scanner/monitorsuggest (NormalizeDomain, stripTags, extractTitle, snippetFromHTML, heuristicRank) Also includes: - Extract shared DB helpers to reduce postgres/sqlite duplication - Fix various test expectations to match actual implementation behavior - Fix case-sensitivity behavior documentation in dsieve rootDomain Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Trufflehog now requires Go >= 1.25.0, updated base image from golang:1.24-bookworm to golang:1.25-bookworm. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
DNS Module Fixes: - Filter out summary lines from DNS results (=== headers, Scan Date, etc.) - Add isSummaryLine() helper to prevent noise in findings table - Clean up DNS takeover result parsing Takeover Reference Feature: - Add comprehensive takeover reference database (76 subdomain + 40 DNS providers) - Parse can-i-take-over-xyz and can-i-take-over-dns tables into JSON - Create searchable web UI with tabs for subdomain and DNS takeovers - Add status badges (Vulnerable/Not Vulnerable/Edge Case) - Include fingerprints, documentation links, and verification status - Export checkTakeoverExploitability() function for validation - Add /static/data route to serve JSON reference files - Integrate into Security Lab with new "Takeover Reference" tab Files Added: - internal/api/ui/securitylab/takeover-reference.html (searchable UI) - internal/api/ui/securitylab/takeover-reference.js (data loading/filtering) - scripts/parse_takeover_tables.go (markdown table parser) - web/static/data/subdomain-takeover.json (76 entries) - web/static/data/dns-takeover.json (40 entries) This allows users to: 1. Validate if DNS scan findings are actually exploitable 2. Search through 116+ takeover scenarios with fingerprints 3. Access up-to-date vulnerability status for services/providers 4. Get direct links to documentation and PoC instructions Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
…emove all emojis - Replace external takeover-reference.html link with full inline panel in securitylab/index.html (tabs, search, stats, tables). - Move takeover reference JavaScript to takeover-reference.js and include it via <script src>. - Remove all emojis across internal/api/ui/ and related files. - Clean up leading-space artifacts from emoji removal. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- Make serveStaticData search multiple base dirs (cwd, exe dir, macOS bundle parent) so JSON reference data loads regardless of where the binary is launched from. - Remove remaining emojis from web/static/data/*.json reference files. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
The previous security check tested the absolute path against a relative prefix, causing all valid requests to be rejected with 404. Validate the relative path first, then stat absolute candidates. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Strip all emojis, Unicode symbols (checkmarks, bullets, arrows, folder icons, mathematical symbols), and decorative characters from every file in the project — Go source, JS, HTML, and Markdown READMEs. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The serveStaticData handler reads from the filesystem, but the Dockerfile never copied web/static/data/ to the runtime stage. This caused 404s for subdomain-takeover.json and dns-takeover.json. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Strip all [WORD] text placeholders that replaced emojis. These showed as visible text in the UI which was not intended. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The side panel that showed raw JSON when clicking a finding row overlapped with the bottom detail panel. Removed entirely. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.