Version 1.27b: -------------- - Tweak to CFLAGS ordering to always enforce FORTIFY_SOURCE. - Man page added. Version 1.26b: -------------- - phtml added to the dictionary. - Yet another workaround for MALLOC_CHECK_. Grr. Version 1.25b: -------------- - A limit on the number of identically named path elements added. This is a last-resort check against endless recursion (e.g., for 'subdir' -> '.' symlinks). Version 1.24b: -------------- - XSS detection now accounts for commented out text. Version 1.23b: -------------- - A minor improvement to XHTML detection. - HTML vs XHTML mismatches no longer trigger a warning. Version 1.22b: -------------- - URL parser now accounts for its own \.\ injection pattern. Version 1.19b: -------------- - New ODBC POI added. - Apache config file detection tightened up. Version 1.18b: -------------- - Fix a potential NULL ptr deref with malformed Set-Cookie. - Another last-resort HTML detection pattern added. Version 1.17b: -------------- - JS detector refined not to trigger on certain text/plain inputs. Version 1.16b: -------------- - Fixed a typo introduced in 1.16 to index.html (d'oh). - Further refinements to Makefile CFLAGS / LIBS / LDFLAGS to keep package maintainers happy. Version 1.15b: -------------- - Better documentation on why certain issues are not reported by skipfish. - Another minor tweak to improve path mapping detection logic. Version 1.14b: -------------- - Several new wordlist entries, courtesy of Glastopf Honeypot: http://glastopf.org/index.php - A tweak to path mapping detection logic to detect certain path mappings that may result in crawl loops. - Makefile now honors external LDFLAGS, CFLAGS. - Some more documentation tweaks and rewrites. - PUT detection logic added. Version 1.13b: -------------- - Improved password, file form detection slightly. Version 1.12b: -------------- - Improved visibility of the KnownIssues page (reports, Makefile). - The location of assets/ directory is now configurable. Version 1.11b: -------------- - SIGWINCH support: you can now cleanly resize your window while scanning. - Typo in report category name fixed. - Terminal color fix (for users with non-standard color themes). - Corrected icons license (GPL -> LGPL). - Fixed a typo in -b ffox headers. - Fixed a potential NULL ptr deref when doing form parsing. Version 1.10b: -------------- - Fix to extensions-only.wl (some bad keywords removed). Version 1.09b: -------------- - Fix for a potential NULL ptr deref in probabilistic scan mode (<100%). Version 1.08b: -------------- - A minor improvement to XHTML / XML detection. Version 1.07b: -------------- - Several build fixes for FreeBSD, MacOS X (-I, -L paths). Version 1.06b: -------------- - Minor documentation updates, typos fixed, etc. Version 1.05b: -------------- - A more robust workaround for FORTIFY_SOURCE (MacOS X). Version 1.04b: -------------- - Workaround for *BSD systems with malloc J or Z options set by default (0x5a5a5a5a deref after realloc()). - A minor tweak to reject certain not-quite-URLs extracted from JS. Version 1.01b: -------------- - Workaround for a glitch in FORTIFY_SOURCE on Linux (causing crash on startup). Version 1.00b: -------------- - Initial public release.