v0.5.4

Changelog

• 37089c9 feat: make httpx hard timeout configurable

v0.5.3

Changelog

• 20da256 feat: show last processed host in stale progress logs

v0.5.2

Changelog

• b585071 perf: add 15-minute hard timeout to httpx

v0.5.1

Changelog

• afc689a perf: reduce httpx timeout and retries for faster probing

v0.5.0

Changelog

• e2a448a feat: HAR data enrichment — discover, analyzer, collector

v0.4.0

Changelog

• 81808e0 feat: add 2025+ security probes and analyzer rules
• 9d01ad9 feat: replace LLM API with investigation file generator

v0.3.1

SmartFuzz: Discovered-Prefix Expansion + Custom 404 Calibration

Discovered-Prefix Expansion

Instead of only trying hardcoded prefixes (/manage/, /admin/), SmartFuzz now extracts all path prefixes from pipeline data (urls.txt + endpoints.json) and uses them for every probe.

Crawl found:  /portal/app/dashboard
              /api/v3/users/123

Now tries:    /portal/swagger.json
              /portal/app/swagger.json
              /api/swagger.json
              /api/v3/swagger.json
              ... for ALL probes (.env, actuator/health, etc.)

Discovered prefixes are prioritized over hardcoded fallbacks. New "discovered-prefix" source type in findings.

Custom 404 Baseline Calibration (Phase 0)

Before probing, sends two requests with different-length random paths to each host:

GET /rc0-a3f8c2d1       → 200, 4840 bytes, "a3f8c2d1 not found"
GET /rc0-a3f8c2d1extra  → 200, 4852 bytes, "a3f8c2d1extra not found"

Detects two types of custom 404 pages:

1. Fixed template — body size constant regardless of path
2. Path-reflecting — body includes the requested path (e.g. "swagger.json not found"), body size varies with path length

For path-reflecting servers, normalizes expected body size:

expected = baseline_size + (probe_path_len - calibration_path_len)

Only filters when BodyStable=true (both calibration requests consistent). ExpectBody patterns always override the filter — real findings are never suppressed.

Other Changes

• max_probes_per_host default raised from 100 to 500
• Hardcoded prefixes kept as fallback when no discovered data exists

Full Changelog

v0.3.0...v0.3.1

v0.3.0

SmartFuzz — Intelligent Fuzzing Provider

Replaces activeprobe with a much more capable smart fuzzing engine.

Why?

activeprobe missed Spring Boot actuator endpoints on targets like nasa.gov because:

1. Tech detection dependency — probes only ran if httpx detected "Spring"/"Java". Behind CDN/proxy, tech is invisible.
2. Single path, zero variation — only checked /actuator/env, never /manage/actuator/env or /api/actuator/env.
3. Limited probe list — ~40 probes covering only basic paths.

What's New

Universal Probes — ~20 probes sent to EVERY host regardless of detected tech:

• .env, .git/HEAD, actuator/health, swagger.json, graphql, wp-login.php, debug/pprof/, phpinfo.php, and more

Runtime Tech Discovery — universal probes double as tech detectors:

• /actuator/health returns 200 → Spring Boot detected → triggers all Spring Boot probes
• /wp-login.php returns 200 → WordPress detected → triggers WP probes
• /debug/pprof/ returns 200 → Go detected → triggers pprof probes

Prefix Expansion — each tech-specific path is tried with 11 prefix variations:

/actuator/env → /manage/actuator/env, /admin/actuator/env, 
/api/actuator/env, /api/v1/actuator/env, /v2/actuator/env, ...

Expanded Probe Lists — ~120 probes across:

• Spring Boot (25 actuator + swagger paths)
• Swagger/OpenAPI (12 variations)
• phpMyAdmin (10 paths)
• WordPress (10 paths)
• Go pprof (10 paths)
• Laravel, Django, .NET, Node.js

Discovery-Based Fuzzing — uses pipeline data (endpoints.json) for:

• Path sibling discovery (/api/v2/users/ → try /api/v2/admin/)
• Extension swaps (.json → .yaml, .bak, .old)
• URL pattern deduplication

CDN-Aware — cdn_mode config:

• skip — skip CDN-hosted targets entirely
• critical_only (default) — only universal probes for CDN targets
• full — send everything (aggressive)

CORS Check — optional CORS misconfiguration detection

Config

providers:
  smartfuzz:
    enabled: true
    timeout: 10s
    max_concurrent: 30
    skip_cors: false
    cdn_mode: critical_only
    prefix_expansion: true
    discovery_fuzz: true
    max_probes_per_host: 100

Full Changelog

v0.2.0...v0.3.0

v0.2.0

What's New

Multi-Domain Support

Scan multiple root domains in a single pipeline run — results are merged and deduplicated automatically.

# Comma-separated
recon0 run target.com,api.target.com,dev.target.com --program acme

# From file
recon0 run -l targets.txt --program acme

All providers (subfinder, amass, dnsx, httpx, etc.) process domains in parallel. No config changes needed.

Also in this release

• One-liner install script — curl -sSL https://raw.githubusercontent.com/badchars/recon0/main/install.sh | bash
• recon0 uninstall [--purge] — clean removal of binary and optionally all scan data
• Background update check — a non-blocking notice when a new version is available

Upgrade

sudo recon0 update

Full Changelog

v0.1.0...v0.2.0

v0.1.0

Changelog

• 1d47725 Initial commit: recon0 — all-in-one bug bounty recon pipeline
• 006ca11 feat: add amass provider + fix subfinder timeout
• 069a2c8 feat: add self-update command + automated release pipeline
• a0763ee fix: add missing cmd/recon0/main.go and set Go 1.23 compatibility
• 9061be5 fix: httpx live progress — monitor JSON output instead of empty file