THE CYBER TOOLCHAIN
NO. 013
The daily firehose — everything the toolchain shipped today, already filtered.
We read every release from the 1309 tools on our watchlist at the source — GitHub and GitLab release notes, vendor release pages and changelogs, project blogs and feeds, vendor press releases, and the source code behind the tag. Bug-fix-only releases and non-product newsroom noise are dropped; what's left is summarized down to the new capability, how to try it, and any screenshots or videos the release itself published. Every entry links to the sources it was built from.
Focus: What features shipped and what problems they solve, plus launches, packaging and where the market is moving.
Leaves out: Command-line flags, API-only deltas, usage examples, and releases that are only refinements.
Focus: New security controls, new APIs, and product improvements you can put to work, plus anything an upgrade breaks.
Leaves out: Launch and marketing news, governance, pricing, and documentation changes with no operational effect.
Focus: Dashboards, reporting, and anything you can quantify: metrics, coverage, risk scores, compliance impact, vendor moves.
Leaves out: Settings, flags, API and command-line detail, library bumps, and minor releases with no reporting or posture angle.
Focus: API, SDK and MCP changes, new libraries, breaking changes in what you import, and cyber tooling.
Leaves out: Governance, SOC operations, and vendor launches with no developer surface.
This issue came out before editions were ranked, so it shows the Standard edition in issue order.
$ tct list # 3 tools matched
Fast web fuzzer written in Go
ffuf v2.2.0 adds audit logging to record all fuzzing activity for compliance and review.
$ git clone --branch v2.2.0 https://github.com/ffuf/ffuf.git # already have the repo? check out this version: $ git checkout v2.2.0
The Prime Cross Site Request Forgery (CSRF) Audit and Exploitation Toolkit.
XSRFProbe v3 rebuilds the CSRFCSRFCross-site request forgery, an attack that makes a signed-in browser send an unwanted request to a site. The site may accept the request using the victim's existing session. engine with 25 categorized checks, headless-browser SameSite bypasses, and JSON reporting.
$ git clone --branch v3.0.0 https://github.com/0xInfection/XSRFProbe.git # already have the repo? check out this version: $ git checkout v3.0.0
$ xsrfprobe --url https://target.example.com --browser --json
$ xsrfprobe --url https://target.example.com --max-urls 50 --max-depth 2 --crawl-timeout 120 --json
$ xsrfprobe --url https://target.example.com --browser --auto-validate-poc --geckodriver-path /opt/geckodriver/geckodriver
Origin: null against real-world validation implementations.SameSite=Strict via client-side redirect gadgets and sibling-subdomain XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session., and SameSite=Lax via cookie-refresh/OAuth flows.--browser for browser-dependent SameSite bypass tests and auto-validation of generated PoCs.--max-urls, --max-depth, and --crawl-timeout flags to control scan scope.--json flag for machine-readable JSON reports; each finding includes test_id, severity, and an exploitability note.10 details in Everything
DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:
DOMPurify 3.4.12 adds support for new SVG attributes alongside hardened handling of declarative partial updates.
$ git clone --branch 3.4.12 https://github.com/cure53/DOMPurify.git # already have the repo? check out this version: $ git checkout 3.4.12
2 details in Everything