Tags: devploit/nomore403

NoMore403 v2.0.0

This release marks a major update from the 1.4.x line.

Highlights:
- Added replayable scoring and richer result summaries for likely bypasses and interesting parser variations.
- Reduced output noise with per-technique and cross-technique deduplication, smarter suppression, and cleaner terminal UX.
- Expanded bypass coverage with host override, suffix tricks, stronger raw desync variants, forwarded trust and frontend-focused mutations.
- Improved raw HTTP handling for exact request-targets and non-standard unicode path forms such as %uXXXX.
- Added frontend fingerprint hints and technique prioritization without disabling the full default technique set.
- Enriched JSON and JSONL output for automation and evidence collection.
- Reworked the README and usage documentation to match the current engine and workflow.
- Added and updated tests across the new request, scoring, replay, raw HTTP, and output paths.

This version is intended to be a usability and engine upgrade, not just an incremental payload refresh.

fix: add explicit permissions to release workflow

Set contents: write (least privilege) for GoReleaser to create
releases. Closes #6.

feat: add input list, JSON output, unicode encoding, and custom paylo…

…ad positions

New features:
- Input list support: -u flag now accepts a file containing URLs (one per line) (#37)
- Output to file: -o flag saves results to a file; --json outputs in JSON format (#37)
- Unicode encoding technique: overlong UTF-8 and %uXXXX encoded path bypass attempts (#47)
- Custom payload positions: -p flag with markers in URL for targeted payload injection (#34)

Bug fixes:
- Fix HTTP/2.0 request file parsing: "HTTP/2.0" no longer becomes "HTTP/1.1.0"
- Fix query string preservation in double-encoding, midpaths, and path-case-switching
- Fix byte index bug in double-encoding for multi-byte runes
- Fix overlong UTF-8 formula producing incorrect byte sequences

Improvements:
- Add 4 new bypass-relevant endpaths (?&, .., /., ;/)
- Add unicode technique to default technique list (before http-versions)
- Widen main banners (NOMORE403, AUTO-CALIBRATION) to 56 chars for visual hierarchy
- Thread-safe JSON result accumulation with mutex
- Comprehensive test coverage for all new features and bug fixes (29 tests passing)

Closes #37, closes #47, closes #34

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

v1.2.0 - Reliability, smart output, and UI overhaul

- Graceful degradation: technique failures no longer crash the scan
- Request retries with exponential backoff for transient errors
- Rate limit (429) handled gracefully instead of fatal exit
- Input validation for URIs, request files, and proxy URLs
- curl availability check before HTTP versions technique

- All shared globals replaced with sync/atomic operations
- Eliminates race conditions under concurrent goroutines

- Multi-sample calibration (3 requests) with dynamic tolerance
- Reduces false positives on servers with dynamic content

- Non-verbose mode now filters noise: only shows results that differ
  from the default response (different status code or content length)
- Per-technique dedup: shows 3 examples + count summary
- Verbose mode (-v) unchanged — shows everything

- Inline progress bar per technique on stderr
- TTY-aware: only renders in interactive terminals
- Coordinates with output to avoid visual overlap

- Compact two-column configuration banner
- Content-length colored by divergence from default:
  green (much larger), cyan (larger), blue (similar),
  yellow (smaller), red (much smaller)

- Fix --request-file stripping query strings from URLs (#48)
- Fix malformed error log in response body close handler

- 17 new tests covering all bypass techniques, error handling,
  calibration, input validation, and query string preservation

Fix segfault when invalid URL is parsed

Set go install feature

Update README.md and fix goreleaser version

Update Golang version and dependencies

Update logo and minor refactor changes