yellow

~ opinionated web scanning pipeline for pentesters in a hurry
git clone https://github.com/djnnvx/yellow.git
CHANGELOG.txt (4317B)
      1 ## v0.0.8
      2 
      3 - chore(build): bump Go to 1.27 ~ @djnnvx
      4 - chore(deps): bump dependencies ~ @djnnvx
      5 - feat(scan): robots.txt and sitemap.xml are saved to the scan directory ~ @djnnvx
      6 - fix(cli): target files stream line by line ~ @djnnvx
      7 - fix(cli): fingerprint -d should only run wappalyzer and cvemap ~ @djnnvx
      8 - fix(scan): bind every response body read ~ @djnnvx
      9 - fix(scan): nuclei ignores non-match events, a rate-limited host reported 95913 fake findings ~ @djnnvx
     10 - fix(scan): nuclei groups hits by template and host instead of one entry per URL ~ @djnnvx
     11 - fix(scan): nuclei collapses hosts that answer every path to one target ~ @djnnvx
     12 - fix(scan): nuclei findings record where they hit, matched was empty ~ @djnnvx
     13 - fix(scan): katana drops out-of-scope URLs, third-party hosts were being scanned ~ @djnnvx
     14 
     15 ## v0.0.7
     16 
     17 - feat(meta): ship the run-yellow claude skill in-repo ~ @djnnvx
     18 - feat(scan): gitleaks secret scanning of crawled responses ~ @djnnvx
     19 - feat(osint): ASN/prefix lookup over DNS (cymru, shadowserver fallback), flags provider-owned ranges ~ @djnnvx
     20 - feat(scan): cdncheck annotates resolved IPs, skips port-scanning WAF edges ~ @djnnvx
     21 - fix(osint): shodan dedupes by resolved IP instead of querying once per hostname ~ @djnnvx
     22 - feat(scan): katana headless crawl, feeds discovered URLs into nuclei and gobuster ~ @djnnvx
     23 - fix(docker): multi-stage image with chromium, CGO off, httpx screenshots work again ~ @djnnvx
     24 - fix(net): probe https then fall back to http, http-only hosts were skipped ~ @djnnvx
     25 - fix(scan): open ports nerva cannot fingerprint no longer vanish from portscan.json ~ @djnnvx
     26 - chore(deps): bump dependencies ~ @djnnvx
     27 - refactor(core): dead code deletion, simplification ~ @djnnvx
     28 - fix(osint): gau init errors for one provider dont bring everything down  ~ @djnnvx
     29 
     30 ## v0.0.6
     31 
     32 - refactor(core): shared Module interface + Context for all scan/osint tools ~ @djnnvx
     33 - feat(scan): add tlsx TLS certificate grabbing ~ @djnnvx
     34 - feat(scan): add nuclei vulnerability scanning (opt-in, --nuclei) ~ @djnnvx
     35 - feat(osint): add gau historical URL discovery ~ @djnnvx
     36 - feat(osint): add alterx subdomain permutation + resolution ~ @djnnvx
     37 - change(cli): gobuster is now opt-in via --gobuster ~ @djnnvx
     38 - fix(scan): fetch the real robots.txt (was duplicating the sitemap) ~ @djnnvx
     39 - fix(net): HTTP timeouts, close response bodies, survive IP-lookup failure ~ @djnnvx
     40 - fix: replace panics and log.Fatal with graceful skips across scan/osint ~ @djnnvx
     41 - fix(cli): prune flag fixes and accurate scan help ~ @djnnvx
     42 - fix(helpers): clean exits and directory-creation error reporting ~ @djnnvx
     43 - fix(scripts): set -euo pipefail and portable shebangs ~ @djnnvx
     44 - chore(cleanup): drop dead code, fmt over builtin println, satisfy staticcheck ~ @djnnvx
     45 - chore(build): align Go to 1.26, copy go.sum in Docker ~ @djnnvx
     46 - chore(deps): bump dependencies ~ @djnnvx
     47 
     48 ## v0.0.5
     49 
     50 - fix(scan): replace dead cvemap/vulnx API with NVD API v2 ~ @djnnvx
     51 - chore(deps): drop github.com/projectdiscovery/cvemap dependency ~ @djnnvx
     52 - fix(osint): only IPs should be passed to shodan ~ @djnnvx
     53 - feat(osint): adding support for leaker ~ @djnnvx
     54 - feat(scan): adding port-scanning ~ @djnnvx
     55 - fix(scan): nested directories while running scan ~ @djnnvx
     56 - fix(git): conflicts ~ @djnnvx
     57 - chore(deps): bump dependencies ~ @djnnvx
     58 
     59 
     60 ## v0.0.4
     61 
     62 - feat(scan): saving wappalyzer results to file ~ @djnnvx
     63 - feat(scan): adding cvemap module ~ @djnnvx
     64 - fix(scan): adding --no-dirbusting ~ @djnnvx
     65 - feat(meta): adding run-web-recon script ~ @djnnvx
     66 - feat(cmd): adding fingerprint subcommand ~ @djnnvx
     67 - feat(cmd): adding prune subcommand ~ @djnnvx
     68 - chore(meta): document new subcommands ~ @djnnvx
     69 - feat(osint): adding experimental shodan module ~ @djnnvx
     70 
     71 
     72 ## v0.0.3
     73 
     74 - feat: bumping gobuster to latest version (unstable) ~ @djnnvx
     75 - feat: bumping goflags ~ @djnnvx
     76 - fix: updating docs ~ @djnnvx
     77 - feat: updating httpx ~ @djnnvx
     78 - feat: updating naabu ~ @djnnvx
     79 - feat: updating subfinder ~ @djnnvx
     80 - feat: updating wappalyzergo ~ @djnnvx
     81 - feat: updating cobra ~ @djnnvx
     82 - feat(dnsx): adding TXT domain enumeration ~ @djnnvx
     83 - fix(osint): TXT records in parsed domains + file cleanup ~ @djnnvx
     84 - feat(scan): dropping support for port-scanning ~ @djnnvx
     85 - feat(build): adding goreleaser support ~ @djnnvx