Mirrors gogo's ResourceLoader pattern. SDK spray engine sets it to
no-op after init, preventing RunWithArgs from reloading ports/fingers/templates.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
- parsers.Extracted: add Severity and Items (ExtractItem with ctx/line/offset)
- ProtonExtract: preserve severity from templates, capture N-char context around matches
- Add --extract-context CLI flag (default 0, e.g. --extract-context 50)
- Add word matchers pre-filtering to 14 existing templates for performance
- Add 9 new HaE-inspired rules: lfi-indicator, upload-form, url-as-value,
location-redirect, mac-address, sensitive-field, linkfinder, url-schemes,
authorization-header
- Total proton templates: 45 (was 35)
- Update ColorString/TreeString to render severity and context
- Comprehensive tests for severity, context, new templates, tag mappings
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
gomod (grouped golang.org/x/* and chainreactors/*) plus github-actions where present. No ignore on chainreactors/* so inter-repo deps are auto-updated.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
The replace pinned a pre-v1.0.3 pseudo-version up to the v1.0.3 release.
proxyclient v1.1.0 is now published, so require it directly and remove
the replace. Core schemes (SOCKS/SOCKS5/HTTP/HTTPS) cover spray's proxy
use; the extra protocols (trojan/vmess/ssh/...) are split into separate
modules in v1.1.0 but spray doesn't use them. go build ./... passes.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
go generate with the updated templates submodule (7d5675c) produces
different embedded data and code. Key changes:
- cmd/cmd.go: logs.Info/Important → logs.InfoLevel/ImportantLevel
- pkg/templates.go: remove proton_rules.bin/neutron.bin embeds (no longer needed)
- core/baseline: use ProtonExtract instead of Extractors.Extract
- core/format: list proton extractor names
- Update embedded binary data files
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
The file was referenced by //go:embed but never committed,
causing build failures when consumed as a remote Go module.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
Fingers now defaults to RE2 regex engine with AC pre-filtering.
No build tag changes needed — RE2 is the new default.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
When ctx is cancelled (e.g. IsFailed threshold), the Run loop breaks
and stops reading additionCh. But doCheck (now via addAddition) may
have queued items with wg.Add(1) that no one consumes. Close().wg.Wait()
hangs forever.
Fix: spawn a drain goroutine in Close() before wg.Wait() that consumes
and Done()s remaining additionCh items, then close the channel after
Wait returns.
Verified: 16 IPs x 2 ports x 1000 words completes with EXIT 0.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
Supports check mode (exploit verification via finger field) and brute mode
(default credential testing via zombie/tags field). POC templates are only
executed against targets whose fingerprints match, avoiding blind scanning.
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
Root cause: doCheck() called reqPool.Invoke() from the Handler goroutine.
When all reqPool workers blocked on sendProcess waiting for Handler to
drain processCh, and Handler blocked on Invoke waiting for a free worker,
a circular wait formed.
Fix: doCheck now uses addAddition() to submit check requests via
additionCh consumed by the Run loop, breaking the circular dependency.
Before: 16 targets x 500 words = HANG (>130s)
After: 16 targets x 500 words = 1.8s
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
Root cause: the atomic.Bool + polling monitor goroutine pattern had a
race between wg.Wait() in the monitor and wg.Add(1) in the main loop.
When the monitor observed done=true and started Wait, the main loop
could still dispatch new work, causing Close().wg.Wait() to hang.
Fix: replace with nil-channel + sync.Once pattern. When the word stream
exhausts or limit is hit, worderCh is set to nil (disabling that select
branch permanently), then a single goroutine waits for wg to reach zero.
Since wg.Add(1) only occurs in the worderCh branch, nil-ing it before
Wait guarantees no new Add after Wait starts — no race possible.
Other fixes:
- Task feeder goroutine now ctx-aware (prevents leak on cancel)
- AddPool checks Invoke error (prevents poolwg counter mismatch)
- Revert resource_provider IIFE (reading a struct field cannot panic)
- Remove E2E -short skip (race is fixed, full coverage in CI)
- Fix Go 1.24+ vet: non-constant format strings in Init()
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
Bug fixes:
- Defer scopeLocker.Unlock in doScopeCrawl (deadlock on panic)
- Defer statsMu.Unlock in recordStat (deadlock on panic)
- Defer RUnlock in resource_provider.LoadConfig via inline func
- Fix data race in invoke(): move bl field writes before doRedirect
- Close response body on ReadAll error (connection leak)
- Add defer raw.Close() for raw file parsing (fd leak)
- Safe type assertion in load.go keyword parsing (panic on bad YAML)
- Check ants pool creation errors in NewBrutePool/NewCheckPool
New tests (15 test functions):
- pool_test.go: scopeLocker panic recovery, cancel mid-processing,
single-threaded map access, valid pool creation
- runner_test.go: concurrent recordStat safety, nil stat handling
- load_test.go: malformed YAML tolerance, valid YAML loading
- e2e_test.go: normal brute scan, context cancellation, server errors,
WAF behavior, multi-target check mode, mixed status codes
CI hardening:
- Add -race detector (Linux, -short mode)
- Add -timeout 300s to prevent deadlock hangs
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
- go:generate now uses -embed flag to produce //go:embed binary data
- templates.go reduced from 125KB base64 source to 0.9KB + 93KB .bin files
- binary saves ~28KB (removes base64 decode overhead at runtime)
- templates submodule updated with embed-aware generator
Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
Add 19 tests in core/pool/pool_test.go covering:
- addAddition: normal, after cancel, wg balance, full buffer, concurrent
- sendProcess: normal, after cancel, full buffer, concurrent
- putToOutput/putToFuzzy: normal, after cancel, Outwg balance
- Handler lifecycle: processCh close exits handler, drains all items
- Shutdown sequence: no deadlock, cancel mid-flight
- Goroutine leak detection after full shutdown
Add .github/workflows/ci.yml:
- Runs on PR to master and push to master
- Tests on ubuntu-latest and windows-latest
- go build, go test -race, go vet
Co-Authored-By: Claude Opus 4.6 <[email protected]>
- Replace close(additionCh) with additionClosed atomic.Bool flag to
prevent panic when async producers (redirect/crawl/retry/append)
write after pool shutdown
- Guard addAddition() with ctx.Err() and additionClosed check before send
- ParseRawResponse failure no longer marks baseline as invalid or
returns early; log at debug level instead
- Read Location header from live response (resp.GetHeader) instead of
re-parsed bl.Response.Header for reliability
- Add ParseRawResponse boundary tests (nil, empty, truncated, binary, etc.)
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* Initial plan
* Fix --recon plugin to extract both pentest and info data
The --recon flag was only extracting items tagged as "pentest", missing
important reconnaissance information tagged as "info" such as phone numbers,
emails, and ID cards. This caused the plugin to appear broken compared to v1.2.1.
Changed BuildPlugin() to combine both "pentest" and "info" tagged extractors
when ReconPlugin is enabled, restoring the expected behavior of extracting
comprehensive reconnaissance data including:
- Phone numbers (info)
- Email addresses (info)
- AWS keys (pentest)
- Passwords (pentest)
- And other sensitive information
Tested with a sample HTML page containing phone, email, and AWS key data,
confirming all three are now properly extracted and displayed.
Co-authored-by: chainreactorbot <[email protected]>
* Add *.stat to .gitignore and remove test stat file
* Optimize --recon extractor initialization with pre-allocated capacity
Address code review feedback by pre-allocating the slice capacity based on
the combined size of pentest and info extractors. This avoids multiple
reallocations during append operations, improving performance.
Also simplified the conditional checks to use len() instead of map lookups,
which is more idiomatic and slightly more efficient.
Tested with multiple extraction types (phones, emails, IPs, AWS keys) and
confirmed all are properly extracted.
Co-authored-by: chainreactorbot <[email protected]>
* Simplify --recon extractor code by removing unnecessary length checks
Remove redundant length checks before append operations. The append operation
with spread operator safely handles empty slices without requiring explicit
guards, making the code cleaner and more idiomatic.
This change does not affect functionality - empty slices are appended safely
without any performance penalty.
Co-authored-by: chainreactorbot <[email protected]>
* Add nil-safety for --recon extractor initialization
Extract pentest and info extractors into variables before using them. This
approach is nil-safe because len() on nil slices returns 0 and append() with
nil slices works correctly in Go. This also makes the code cleaner by avoiding
repeated map lookups.
Addresses code review feedback about potential panics if the extractor maps
don't exist or are nil.
Co-authored-by: chainreactorbot <[email protected]>
* Remove binary and add spray to .gitignore
* Remove binary from repo and update .gitignore
Co-authored-by: chainreactorbot <[email protected]>
* Remove stat files that should be ignored
* Fix .gitignore to properly exclude stat files and binary
Co-authored-by: chainreactorbot <[email protected]>
* Complete --recon functionality fix with security verification
Co-authored-by: chainreactorbot <[email protected]>
* Revert go.mod and go.sum to keep go 1.20 version
按用户要求，不升级 go.mod 版本，保持原样：
- 恢复 go 版本从 1.21 到 1.20
- 移除 toolchain go1.24.12 行
- 恢复 go.sum 到之前的状态
已验证：
- 代码可以成功编译
- --recon 功能正常工作（提取 phone 和 mail）
- 所有功能保持不变
Co-authored-by: chainreactorbot <[email protected]>
---------
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: chainreactorbot <[email protected]>
