Skip to content

CHANGELOG.md

Latest commit

 

History

History
236 lines (190 loc) · 17.6 KB

CHANGELOG.md

File metadata and controls

236 lines (190 loc) · 17.6 KB
Raw

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

[1.1.3] - 2026-04-01

Changed

  • Complete mobile responsive overhaul - Rewrote CSS breakpoints at 768px and 480px for proper full-width mobile layouts, stacked export buttons, responsive email/MX/service cards, and eliminated horizontal scrolling with overflow-x: hidden

Fixed

  • Dark mode inline style colors - Replaced hardcoded colors in inline styles with CSS variables (var(--text-primary), var(--text-secondary), var(--bg-tertiary), var(--accent-blue), var(--accent-yellow)) across ui-renderer.js, visualizer.js, app.js, and index.html for proper dark mode support
  • API provider resilience - Providers that fail 3 consecutive fetches are now marked unavailable for the session instead of retrying indefinitely; blocklists that return "query blocked" are skipped for the remainder of the session
  • Consolidated API notification methods - Deduplicated four separate notification helpers into a single notifyAPIStatus() method in dns-analyzer.js

Optimizations

  • Code deduplication in app.js - Extracted shared runAnalysis() wrapper and parseDomainInput() helper, eliminating ~60 lines of duplicated logic between analyzeStandard() and analyzeQuickEmail()
  • Removed ~85 lines of unused code - Removed mergeSubdomainData(), getServicesByCategory(), getServicesByVendor(), getVendorFromService() from data-processor.js; hideAllVendorSections() from ui-renderer.js; unused analysisAbortController variable from app.js
  • Logging cleanup - Replaced raw console.log/console.error calls with conditional window.logger.debug() across app.js and data-processor.js; removed verbose debug logging from data sovereignty analysis

[1.1.2] - 2026-03-31

Added

  • Infrastructure exposure detection via CNAME records - New finding type that analyzes CNAME target hostnames for leaked infrastructure details (Kubernetes, GitLab, Kong, PostHog, Redis, internal markers, etc.). Detects when DNS records publicly reveal technology stack, service names, or internal architecture. Findings are categorized as Low (technology/architecture exposure) or Informational (sensitive business context) and appear in UI, PDF, Markdown, and JSON exports.
  • DNS firewall exposure detection - New security observation that identifies subdomains with directly exposed hosting IPs when >25% of active subdomains are behind DNS firewall/CDN services (Cloudflare, Akamai, Fastly, etc.). Highlights inconsistent protection as a low-severity concern.

Fixed

  • Private IP subdomain names in security findings - Security findings for internal IP exposure now include the affected subdomain name in PDF, Markdown, and all export formats (previously only showed the IP address)
  • Misleading Shodan data for internal IPs - Private/internal IP subdomains now display "Internal IP" instead of "N/A" for open ports and "N/A" instead of "None" for vulnerabilities across UI, PDF, Markdown, and XLSX exports. Previously indistinguishable from "queried but nothing found"
  • Unnecessary API calls for private IPs - ASN and Shodan lookups are now skipped entirely for private/internal IP addresses, avoiding wasted API calls that would always return empty results
  • Internal IPs on CNAME chains (RFC1918 from A records) - Canonical IPv4 is taken from subdomain.ip or A records when ip was missing, so enrichment reliably skips Shodan/ASN, marks isPrivateIP, and no longer leaves shodanInfo: null on finished scans
  • JSON export for internal subdomains - Serialized subdomains now include stable fields: isPrivateIP, resolvedIPv4, shodanInfo with { notApplicable: true } where appropriate, and asnInfo cleared for private hosts instead of placeholder "Unknown" objects

[1.1.0] - 2026-03-22

Added

  • Shodan InternetDB integration - New integration with Shodan's InternetDB API to enrich subdomain data with open ports, known vulnerabilities (CVEs), and service banners. All queries are made client-side with no API key required.
  • Subdomain Overview table - New consolidated view showing all discovered subdomains with IP addresses, providers, open ports, and vulnerabilities in a single table. Provides a clear security overview of discovered infrastructure matching the export format.
  • Clickable port numbers linking to Shodan - Port numbers in the Subdomain Overview table link directly to Shodan host pages (e.g., https://www.shodan.io/host/x.x.x.x) for detailed service information.
  • Loading indicator for Shodan data - Visual progress indicator while Shodan InternetDB queries are in progress, showing how many IPs have been scanned.

[1.0.6] - 2025-12-24

Added

  • JSON Import functionality - Import previously exported analysis results to view them again without re-running analysis. Supports full data restoration including services, subdomains, security findings, and visualizations

Changed

  • PDF export optimization - Improved space management and layout for better readability and reduced file sizes
  • UI enhancements - Improved button styling and sponsor view presentation

Fixed

  • HTML escaping - Fixed HTML escaping issues in exports and display that could cause rendering problems
  • JSON import/export compatibility - Fixed data serialization and deserialization to ensure imported results match original analysis

Security

  • Service worker message origin validation - Added origin check to service worker postMessage handler to prevent untrusted windows from sending messages. Messages are now validated against the service worker registration scope before processing

[1.0.5] - 2025-12-24

Added

  • Shared utilities module (js/common.js) - Centralized common functions including secure isDomainOrSubdomain() helper
  • SPF include third-party detection - Identifies third-party email sending dependencies in SPF records
  • Two-button scan mode UI - Simplified interface with "Analyze Domain" (full analysis) and "Quick + Email Checks" (fast mode)
  • Email security enhancements - SPF chain analysis, MTA-STS, BIMI, TLS-RPT detection, and email security dashboard
  • Service detection expansion - Added detection for monitoring (Splunk, PagerDuty, Grafana, Opsgenie), CI/CD (CircleCI, GitLab, Travis, Jenkins), workflow automation (Make, Tray.io, n8n), and payment services (Adyen, Braintree, Klarna, Mollie)
  • DNSSEC validation - Checks DNSSEC configuration with DNSKEY and DS record analysis
  • Blocklist integration - SURBL and URIBL checking alongside Spamhaus DBL
  • Dangling NS detection - Identifies nameserver takeover vulnerabilities
  • Visual analytics - Interactive network graph, geographic distribution map, and certificate timeline
  • PWA support - Progressive Web App with offline functionality
  • Batch analysis - Analyze up to 10 domains simultaneously
  • Export formats - JSON, PDF, Excel (XLSX), Markdown exports
  • Keyboard shortcuts - Power user shortcuts (Ctrl+Enter, Ctrl+E, Ctrl+J, etc.)
  • Shareable URLs - Generate shareable links with pre-filled domain parameters
  • THC API integration - Additional subdomain discovery source via reverse DNS database
  • DANE/TLSA checking - DNS-based authentication for SMTP and HTTPS services
  • Mobile and accessibility improvements - Touch-friendly UI, ARIA labels, keyboard navigation, screen reader support

Changed

  • Simplified scan modes - Merged Quick Scan and Email Scan into single "Quick + Email Checks" mode
  • Refactored domain validation - Moved isDomainOrSubdomain() to shared module, eliminating code duplication

Removed

  • Scan mode dropdown - Replaced with two-button interface
  • Legacy scan modes - Removed separate Quick Scan and Email Scan modes (~220 lines of duplicate code removed)
  • Streamlined exports - Removed CSV, Save Analysis, History, and Compare exports

Fixed

  • RRSIG record processing - Fixed DNSSEC RRSIG records incorrectly processed as NS records
  • DNSSEC record type names - Added proper type names for RRSIG, NSEC, NSEC3, DNSKEY, DS, TLSA, SOA
  • DMARC parsing - Fixed multiple email address parsing in DMARC rua= and ruf= tags
  • Blocklist query fixes - Fixed Spamhaus DBL (TXT → A records), URIBL bitmask logic, SURBL bitmask values
  • DMARC service detection - Added Valimail, EasyDMARC, DMARC Analyzer, MXToolbox, URIports, OnDMARC
  • Security analysis counting - Fixed NaN issue in security analysis results

Optimizations

  • Code deduplication - Centralized domain validation, removed ~220 lines of duplicate code
  • UI enhancements - Collapse/Expand All controls, DNS record counts in section headers
  • Export streamlining - Focused on essential export formats

[1.0.4] - 2025-12-05

Added

  • Excessive CAA entries detection - Security finding when more than 3 CAA (Certificate Authority Authorization) entries are found. Having too many authorized CAs weakens security controls and increases attack surface, effectively leaving the security gate wide open.
  • IP Geolocation API failure notifications - User-visible notifications when IP-to-location mapping APIs fail or are rate-limited. Notifications appear in the API Issues section with clear error messages.
  • 429 Rate limit detection - Proper detection and handling of HTTP 429 (Too Many Requests) errors from IP geolocation APIs. When rate-limited, the tool stops making requests to that provider and switches to fallback providers.
  • Abuse IP and Domain Blocklist Checking - Automatic checking of IP addresses and domains against Spamhaus blocklists (ZEN for IPs, DBL for domains) via DNS over HTTPS. Detects malicious IPs and domains flagged in abuse blocklists and reports them as security findings with appropriate risk levels.

Fixed

  • Rate limit handling - Fixed issue where 429 errors were ignored and requests continued to be sent to rate-limited APIs. Now properly detects 429 status codes and stops retrying rate-limited providers.
  • API failure visibility - IP geolocation API failures are now visible to users through the API Issues notification system, instead of silently failing in the background.

Optimizations

  • Consolidated API notifications - API notifications are now consolidated to show only one notification per service/API, prioritizing errors over warnings. This saves space in the UI and prevents duplicate messages for services like crt.sh, SSLMate CT Search, and HackerTarget.

[1.0.3] - 2025-11-04

Added

  • Raw DNS Records (Zone File Format) - New collapsible section displaying DNS records in zone file table format
    • Positioned immediately after Export section for convenient access
    • Shows main domain and subdomain records with Host Label, TTL, Record Type, and Record Data
    • All record types supported (A, AAAA, CNAME, MX, TXT, NS, CAA, etc.) with FQDN notation
    • TXT records displayed as-is without reclassification (SPF, DMARC, DKIM shown as TXT type)
    • CNAME chains consolidated into single entries showing full resolution path
    • DKIM CNAME chains consolidated (e.g., target.domain. → TXT: "v=DKIM1...")
    • Collapsed by default with monospace font for readability
  • iCloud Mail detection - Added comprehensive Apple iCloud Mail detection via MX, SPF, and DKIM selectors

Fixed

  • Google Workspace false positive - Removed google-site-verification from Workspace detection patterns (only indicates Search Console verification). Now detects via MX, SPF, or googleapps-domain-verification TXT only
  • iCloud Mail misclassified as Microsoft 365 - Fixed overly broad Microsoft DKIM pattern that matched iCloud's sig1, sig2, sig3 selectors. Microsoft pattern now specific to selector1, selector2 only
  • Raw DNS Records section styling - Fixed HTML structure for consistent toggle icon placement and CSS classes
  • GitHub Actions deployment - Added missing theme-toggle.js to deployment workflow and updated file count to 9 JS files

Optimizations

  • Code size reduction - Removed 110 lines of unused code (~1.2% reduction from 8900 to 8790 lines)
    • Removed unused methods from analysis-controller.js: getAnalysisStats(), printFinalStats(), discoverSubdomains() (-23 lines)
    • Removed unused Logger methods: info(), warn(), error(), success(), isDebugEnabled() (-25 lines)
    • Removed unused DNS analyzer methods: printStats(), onSubdomainDiscovered() (-62 lines)
    • Removed dead callback code (subdomain callback infrastructure with no registered callbacks)

Removed

  • deploy.sh - Removed legacy bash deployment script; GitHub Actions workflow now handles all deployments

[1.0.2] - 2025-10-27

Added

  • Proper link styling for subdomain links using --accent-blue for all states (visited and unvisited)
  • Removed duplicate createSubdomainLink() method in ui-renderer.js
  • New global logging utility (logger.js) with debug mode support for conditional console output

Optimizations

  • Removed unused files: service-registry.js and subdomain-registry.js (functionality already implemented elsewhere)
  • Removed duplicate functions: Duplicate getAllServices() in DataProcessor
  • Removed unused functions: startCTQueries(), analyzeSubdomains(), and loadResults()
  • Improved logging: All debug logging now respects debug mode toggle, reducing console overhead
  • Reduced HTTP requests: 2 fewer JavaScript files to load on initial page load (~300 lines of dead code removed)

Security

  • Fixed domain confusion vulnerability: Replaced unsafe includes() domain checks with proper subdomain validation
    • Added isDomainOrSubdomain() helper to ServiceDetectionEngine and DNSAnalyzer classes
    • Fixed S3 bucket detection to validate actual domain hierarchy (prevents s3.amazonaws.com.attacker.com from matching)
    • Fixed subdomain takeover detection to prevent false positives from domain confusion attacks
    • Fixed infrastructure detection in DNS analyzer (AWS, Azure, DigitalOcean, Cloudflare)
    • Fixed DNS server detection in queryDNSServer() - extracts hostname from URL and validates with proper domain checking
    • Addresses all CodeQL security warnings about arbitrary host matching in domain checks

Fixed

  • Fixed dark mode styling for disclaimer recommendation boxes (was too bright with white background)
  • Updated disclaimer text colors to use proper theme-aware colors (#ffc107 for dark mode)
  • Historical records now correctly display discovery source (e.g., "crt.sh", "HackerTarget") instead of "undefined" in UI, PDF, and XLSX exports
  • Source information is now properly preserved throughout the subdomain analysis pipeline
  • Both immediate and batch processing flows now include source tracking
  • PDF and XLSX exports now correctly handle both source (string) and sources (array) formats
  • Fixed dark mode styling for Historical Records table, Geographic Distribution table, and all Data Sovereignty sections
  • All sovereignty cards, alerts, and tables now properly respect dark mode theme
  • Replaced all hardcoded gray colors (#495057, #6c757d) with CSS variables for proper dark mode support

[1.0.1] - 2025-10-27

Changed

  • Optimized PDF export with better space management and compact layout (20-25% reduction in file size)
  • PDF export now includes all data with proper subdomain associations in Services section
  • Fixed PDF Interesting Findings to match webpage display (no longer generates duplicate findings)
  • Added cache busting for CSS and JavaScript files to ensure users get latest updates
  • Migrated from deprecated Cert Spotter API v0 to SSLMate CT Search API v1

Removed

  • Removed OTX AlienVault API integration (requires authentication, not suitable for client-side use)

Fixed

  • Services section in PDF now shows associated subdomains
  • Interesting findings in PDF now match exactly what's displayed on webpage
  • Export manager now properly receives and uses interesting findings from analysis
  • Updated Certificate Transparency subdomain discovery to use new SSLMate CT Search API (fixes CORS errors)

[1.0.0] - 2025-10-24

Added

  • Comprehensive DNS analysis using DoH (DNS over HTTPS)
  • Multiple DNS record type support: A, CNAME, TXT, MX, NS, SPF, DMARC
  • Certificate Transparency log integration via crt.sh and Cert Spotter
  • Threat intelligence integration with OTX AlienVault and HackerTarget
  • Service detection for cloud providers (AWS, Azure, GCP, DigitalOcean, etc.)
  • Email service detection (ProofPoint, Mimecast, Barracuda, Sophos)
  • CDN and hosting service identification
  • Subdomain takeover detection via CNAME resolution checks
  • Internal IP exposure detection for RFC 1918 and reserved IP ranges
  • Private IP detection covering all RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
  • Loopback, link-local, and reserved address detection
  • DMARC policy analysis with detailed tag parsing
  • Security issue categorization by severity (High, Medium, Low)
  • Rich data visualization with service categorization
  • Historical subdomain record tracking
  • CNAME mapping visualization
  • Statistics dashboard with comprehensive metrics
  • Export functionality for analysis results
  • Dark/light theme toggle
  • Debug mode for troubleshooting

Changed

  • Improved service detection accuracy with vendor consolidation
  • Enhanced security analysis with detailed IP range context
  • Optimized DNS query rate limiting
  • Better error handling and user feedback

Security

  • Client-side only architecture - no data sent to external servers
  • DNS over HTTPS for encrypted DNS queries
  • No analytics or user tracking
  • Open source code for security review