Lookyloo

No entries match these filters. Clear filters

1. v1.43.0 Nov 3, 2026 · issue 130

   Lookyloo adds Cloudflare NS-pair pivoting to find captures sharing the same suspected domain owner⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.43.0 https://github.com/Lookyloo/lookyloo.git
   # already have the repo? check out this version:
   $ git checkout v1.43.0

   ⤢ ⤢
   • Pivot on the indexed tuple of Cloudflare NS record pairs to find other captures containing domains with the same suspected owner.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 detail in Everything

   └──▷ BREAKING ON UPGRADE

   • !Python 3.11 or later is now required; deployments running Python 3.10 or older will not be supported.
2. v1.42.0 Oct 5, 2026 · issue 096

   Lookyloo v1.42.0 adds optional video recording of web captures, viewable at Capture > Video after completion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.42.0 https://github.com/Lookyloo/lookyloo.git
   # already have the repo? check out this version:
   $ git checkout v1.42.0

   ⤢
   └──▷ HOW TO FIND IT
   Watch a recorded video of a completed capture to visually verify what a browser rendered during the session.
   📍In the Lookyloo UI, open a completed capture, then navigate to Capture › Video to play back the full recording.
   • Adds optional video recording of captures (requires Lacus 1.27.0+), accessible after capture via Capture > Video; triggering video capture is admin-only on the public instance, but all users can watch recorded videos based on capture visibility.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Most tables now have a copy-to-clipboard button.
   • Changes the default mobile device (replacing Blackberry) used in captures.
   • Adds optional video recording of captures (requires Lacus 1.27.0+), accessible after capture via Capture > Video; triggering video capture is admin-only on the public instance, but all users can watch recorded videos based on capture visibility.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   2 more in Everything

3. v1.41.1 Sep 26, 2026 · issue 087

   Lookyloo v1.41.1 adds console message capture, WebAuthnWebAuthnA web standard that lets a browser prove possession of a passkey or hardware key to a website. It is the browser-facing part of FIDO2 sign-in./OPFSOPFSA browser-native filesystem API, standardized by WHATWG, that gives web apps a private sandboxed storage area with synchronous access from Web Workers, enabling fast local file I/O without server round-trips. exposure, and onion-site tagging via Onion Lookup.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.41.1 https://github.com/Lookyloo/lookyloo.git
   # already have the repo? check out this version:
   $ git checkout v1.41.1

   • Adds a kvrocks config sample at full_index/kvrocks.conf-big_instance for tuning large deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Gathers and renders browser console messages during captures.
   • Exposes WebAuthn entries discovered during page captures.
   • Exposes Origin Private File System (OPFS) entries discovered during page captures.
   • Integrates with Onion Lookup to automatically tag .onion captures and optionally push full captures to AIL.

   5 details in Everything

4. v1.40.1 Jul 28, 2026 · issue 028

   Lookyloo v1.40.1 adds WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. stream visibility, private captures with token access, and background tree-building scripts.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.40.1 https://github.com/Lookyloo/lookyloo.git
   # already have the repo? check out this version:
   $ git checkout v1.40.1

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Restrict a sensitive capture so only admins or a shared temporary token can view it.
   📍In the capture view, open the visibility form and set the capture to Private; share the generated temporary token with authorised recipients.
   • Adds private captures mode — captures visible only to admins or holders of a temporary token.
   • Adds a UI form to change the visibility of an existing capture (e.g. public → private).
   • Adds background scripts to build trees and index archived captures without blocking the main process.

   3 details in Everything

5. advisory CVE-2026-66913 Jul 28, 2026 · issue 128
   • CVE-2026-66913: Unauthenticated Upload Decompression Resource Exhaustion (DoS) in /json/upload and /submit_capture (affects <1.40.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
6. v1.40.0 Jun 19, 2026 · release notes

   Lookyloo v1.40.0 adds support for Locus groups and Ollama capture summaries

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.40.0 https://github.com/Lookyloo/lookyloo.git
   # already have the repo? check out this version:
   $ git checkout v1.40.0

   • Adds lacuses configuration section to define multiple instances in a group for load balancing
   • [Admin only] Adds capability to submit captures to a local Ollama instance for summary generation

   2 details in Everything

7. advisory CVE-2026-55835 Jun 16, 2026 · issue 128
   • CVE-2026-55835: Potential sub-system DoS due to parameter missmatch in notification (affects <=1.39.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
8. v1.39.3 May 30, 2026 · release notes

   New AI export format for capture details and flexible date filtering in recent captures

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.39.3 https://github.com/Lookyloo/lookyloo.git
   # already have the repo? check out this version:
   $ git checkout v1.39.3

   • /api/v1/captures/recent now accepts relative time strings like "2 days ago" instead of only absolute dates
   • Adds a new export method returning capture details formatted for AI model classification (unstable API, high token cost)

   2 details in Everything

9. v1.39.0 May 8, 2026 · release notes

   Lookyloo v1.39.0 adds remote headful captures and a new API to expose Lacus instance configuration.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.39.0 https://github.com/Lookyloo/lookyloo.git
   # already have the repo? check out this version:
   $ git checkout v1.39.0

   • Adds support for remote mode in headless browsers by enabling Remote headfull captures when the underlying Lacus instance supports it, allowing complex JavaScript-heavy sites to be rendered and captured correctly.

   1 detail in Everything

10. v1.38.0 Mar 27, 2026 · release notes

    Lookyloo v1.38.0 adds MISP category configuration, HTML-to-MD export, and auto-monitoring

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.38.0 https://github.com/Lookyloo/lookyloo.git
    # already have the repo? check out this version:
    $ git checkout v1.38.0

    • Adds misp.categories config key to filter capture exports when auto-push is enabled
    • New Rendered HTML page as Markdown option in Actions > Get Forensic Acquisition > Download modal

    2 details in Everything

11. v1.37.0 Feb 26, 2026 · release notes

    Lookyloo v1.37.0 adds domain/TLDTLDThe rightmost label in a domain name (e.g., .com, .gov, .uk), maintained by IANA's root zone. Cyber tools filter or pivot on TLDs to scope scans, flag suspicious registrations, or classify traffic by geography or type. indexing, a smarter search interface, optional wait time for instrumentation, GTM identifier indexing, ION/protobuf support, and web extension cookie passing.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.37.0 https://github.com/Lookyloo/lookyloo.git
    # already have the repo? check out this version:
    $ git checkout v1.37.0

    • Adds optional wait time after the instrumentation ran (for time-based javascript code)
    • Index domains, suffix, and TLDs (even the weird ones)
    • Search interface figures out what the user is looking for (hostname, domain, suffix, or TLD), and returns the captures accordingly
    • Index GTM- identifiers
    • Support more types in POST requests: Amazon ION, protobuf (best effort), broken atom.

    +1 more show less

    • Support [web extension](https://addons.mozilla.org/en-US/firefox/addon/lookyloo/), and passing cookies.

    6 details in Everything

12. v1.36.1 Jan 22, 2026 · release notes

    Adds optional auto-categorization of captures, user-configurable default Playwright browser, and category support for capture import/export

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.36.1 https://github.com/Lookyloo/lookyloo.git
    # already have the repo? check out this version:
    $ git checkout v1.36.1

    • skip.authors and include.labels are not present; this release adds automatic categorization that detects non-JS content in the init script (typically form spam bots) and assigns a category.
    • Adds default_browser config setting to override the Playwright browser used for captures, defaulting to Firefox Desktop to better bypass bot detection.
    • Adds categories support for capture import and export operations.

    3 details in Everything

13. v1.36.0 Dec 15, 2025 · release notes

    Lookyloo v1.36.0 adds public index support for kvrocks and pagination for indexes pages

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.36.0 https://github.com/Lookyloo/lookyloo.git
    # already have the repo? check out this version:
    $ git checkout v1.36.0

    • Add support for kvrocks as the backend for public indexes to prevent ever-growing valkey databases on large public instances.
    • Add pagination for public and hidden indexes pages to enable near-instant rendering and massively speed up web server initialization.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !This release requires kvrocks >= 2.14; upgrading without updating your kvrocks instance will break the service.
14. advisory CVE-2025-66460 Dec 2, 2025 · issue 128
    • CVE-2025-66460: XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. due to lack of escaping in HTML elements passed to Datatables (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.1, affects <=1.35.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
15. advisory CVE-2025-66459 Dec 2, 2025 · issue 128
    • CVE-2025-66459: XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. due to unescaped error message passed to innerHTML (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.1, affects <=1.35.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
16. advisory CVE-2025-66458 Dec 2, 2025 · issue 128
    • CVE-2025-66458: Multiple XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. due to unsafe use of f-strings in Markup (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.1, affects <=1.35.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
17. advisory CVE-2025-65095 Nov 18, 2025 · issue 128
    • CVE-2025-65095: HTML injection due to improper user input sanitization (affects <=1.35.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
18. v1.35.0 Nov 17, 2025 · release notes

    Lookyloo v1.35.0 adds iFrame capture with timestamping, Google Docs/Dropbox download guessing, and free-form subsequent capture URLs.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.35.0 https://github.com/Lookyloo/lookyloo.git
    # already have the repo? check out this version:
    $ git checkout v1.35.0

    └──▷ HOW TO FIND IT
    When analyzing a phishing page that loads content via iFrames, download the rendered iframe content directly from its node in the capture tree to examine what was presented to the victim.
    📍In the capture tree, locate the iframe node, then click Download rendered content on that node to save the iframe's rendered output.
    When a suspicious Google Docs or Dropbox link is captured, trigger an automatic download capture and send the file to Pandora for malware analysis.
    📍On the capture result page, click Guess download link on the Google Docs or Dropbox node, then choose Capture and submit to Pandora from the subsequent capture modal.
    • Supports iFrames captured via Lacus v1.20.0: URLs on iframes now correctly anchor nodes in the capture tree, rendered iframe content is downloadable from its tree node, and all frame contents are submitted for a Trusted Timestamp.
    • Guesses download/export links for Google Docs and Dropbox landing pages, enabling a one-click subsequent capture of the file and direct submission to Pandora.
    • Allows any arbitrary URL to be entered in the subsequent-capture modal so it is captured in the current browser context, including the session's local storage.

    3 details in Everything

19. v1.34.0 Oct 17, 2025 · release notes

    Lookyloo v1.34.0 adds dark mode, TSR to MISP exports, and proxy alerts

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.34.0 https://github.com/Lookyloo/lookyloo.git
    # already have the repo? check out this version:
    $ git checkout v1.34.0

    • Adds dark mode support when the user requests it
    • Adds a new navbar to expose previously hidden endpoints
    • Adds TSR (Threat Reporting System) to MISP exports
    • Adds setting to automatically filter contacts based on a blocklist

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Python 3.9 is no longer supported
20. v1.33.0 Sep 19, 2025 · release notes

    Adds RFC3161 trusted timestamps, .i2p domain capture, and custom theme files

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.33.0 https://github.com/Lookyloo/lookyloo.git
    # already have the repo? check out this version:
    $ git checkout v1.33.0

    • Adds support for RFC3161 Trusted Timestamps to validate HARHARAn HTTP Archive file, a JSON-format log of all network requests and responses captured by a browser's developer tools, used by cyber tools to replay, inspect, or analyze web traffic without re-running a live session., HTML, screenshot, URL, and download content hashes via a Time Stamping Authority (TSA)
    • Enables capturing .i2p domains through the Lacus instance
    • Adds website/web/templates/custom_header.html, website/web/templates/custom_footer.html, website/web/static/css/overrides.css, website/web/static/js/overrides.js, and website/web/custom_csp.py for custom theming

    3 details in Everything

21. v1.32.0 Aug 26, 2025 · release notes

    Lookyloo v1.32.0 adds POST body display in tree nodes, TLDTLDThe rightmost label in a domain name (e.g., .com, .gov, .uk), maintained by IANA's root zone. Cyber tools filter or pivot on TLDs to scope scans, flag suspicious registrations, or classify traffic by geography or type. search, system proxy support, and optional MISP auto-push.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.32.0 https://github.com/Lookyloo/lookyloo.git
    # already have the repo? check out this version:
    $ git checkout v1.32.0

    • Adds init script support for execution before other scripts on page load
    • Adds tld search capability to index domain extensions
    • Enables optional auto-push of findings to MISP
    • Displays POST content in hostnode tree with pretty-printed text, JSON, and multipart formats
    • Shows visual indicator on tree nodes when they contain POST data

    +2 more show less

    • Adds system_proxy support across all modules for automatic proxy verification
    • Adds Mastodon bot integration to automatically verify Lookyloo website via Mastoton

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !API now returns only recent captures listed on index by default instead of all historical captures.
22. v1.31.0 Jun 13, 2025 · release notes

    Lookyloo v1.31.0 adds several new JSON API endpoints for searching captures by various indicators and normalizes pagination support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.31.0 https://github.com/Lookyloo/lookyloo.git
    # already have the repo? check out this version:
    $ git checkout v1.31.0

    └──▷ TRY IT
    Search for captures across multiple indicators like IP, Hostname, URL, and Hash using a single endpoint.
    copy

    $ curl -s "https://<lookyloo-host>/json/advanced_search?ip=1.2.3.4&hostname=example.com"

    Find all IP addresses associated with a specific capture by its UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide..
    copy

    $ curl -s "https://<lookyloo-host>/json/abc123-def456-ghi789/ips"

    Retrieve captures associated with a specific SHA512 hash.
    copy

    $ curl -s "https://<lookyloo-host>/json/hash_info?hash=a1b2c3..."

    • Adds the GET /json/advanced_search endpoint to return captures matching multiple parameters (IP, Hostname, URL, Hash)
    • Adds the GET /json/ip_info endpoint to return captures containing a specific IP address
    • Adds the GET /json/<string:capture_uuid>/ips endpoint to return all IPs contained in a capture
    • Adds the GET /json/favicon_info endpoint to return captures containing a specific favicon
    • Adds the GET /json/<string:capture_uuid>/favicons endpoint to return all favicons in a capture

    +2 more show less

    • Adds the GET /json/hash_info endpoint to return captures containing a resource with a specific hash (sha512)
    • Normalizes JSON API endpoints to support pagination, accept consistent parameters, and return uniform data formats

    7 details in Everything

23. v1.30.0 May 22, 2025 · release notes

    Lookyloo v1.30.0 adds /json/remote_lacus endpoint and Lacus v1.15.0 support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.30.0 https://github.com/Lookyloo/lookyloo.git
    # already have the repo? check out this version:
    $ git checkout v1.30.0

    • Supports Lacus v1.15.0 protocol for remote capture interactions.

    1 detail in Everything

24. v1.29.0 Apr 23, 2025 · release notes

    Lookyloo v1.29.0 adds pre-configured proxy support in the Lacus module.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.29.0 https://github.com/Lookyloo/lookyloo.git
    # already have the repo? check out this version:
    $ git checkout v1.29.0

    └──▷ HOW TO FIND IT
    Route analysis requests through specific proxies like Tor or Wireguard via the Lacus proxy selector UI.
    📍In the Lookyloo UI, navigate to the Lacus module and use the proxy selector to choose your pre-configured proxy (e.g., Tor/SOCKS5).
25. v1.28.1 Apr 9, 2025 · release notes

    Lookyloo v1.28.1 adds storage state handling, multi-Lacus support, file modal, Mastodon bot and remote capture sync.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.28.1 https://github.com/Lookyloo/lookyloo.git
    # already have the repo? check out this version:
    $ git checkout v1.28.1

    └──▷ HOW TO FIND IT
    Analyze and interact with browser storage state within a captured session view.
    📍In the Lookyloo UI, open a capture and use the new storage state panel to get, store, display, or submit the state.
    Configure lookyloo to pull captures from a remote Lacus instance instead of just local ones.
    📍In the Lookyloo UI, use the Pull capture from another instance feature in the capture workflow.
    Send a captured session to a remote Lacus instance for multi-region analysis.
    📍In the Lookyloo UI, use the Push capture to a remote instance feature from the capture details view.
    • Adds the ability to get, store, display and submit storage state for captures
    • Introduces a modal to display downloaded files and submit them to Pandora if possible
    • Adds support for multiple remote Lacus instances to offer multiple uplinks and captures from different countries
    • Adds the ability to search for redirects directly on the index page
    • Adds Pull capture from another instance capability via the UI

    +3 more show less

    • Adds Push capture to a remote instance capability via the UI
    • Renders a cookie name index from storage state and shows cookie name frequency in the storage modal
    • Introduces a Mastodon bot (@lookyloo@social.circl.lu) for automated updates

    8 details in Everything

26. v1.28.0 Feb 18, 2025 · release notes

    Lookyloo v1.28.0 adds headed browser capture, CIRCL Passive DNS triggering, indexing of IPs/TLDs, and capture push to other instances

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.28.0 https://github.com/Lookyloo/lookyloo.git
    # already have the repo? check out this version:
    $ git checkout v1.28.0

    └──▷ HOW TO FIND IT
    Enable a local lacus instance to run interactive, headed browser captures instead of headless ones.
    📍"Edit config/generic.json and set \"allow_headed\": true, then restart the app. In the Web UI, untick 'Use headless browser' under Capture configuration."
    Trigger a headed capture via API with a custom interaction timeout.
    shell copy

    curl -X POST https://<lookyloo-instance>/api/capture \
      -H 'Content-Type: application/json' \
      -d '{
        "url": "https://example.com",
        "capture_settings": {
          "headless": false,
          "general_timeout_in_sec": 120
        }
      }'

    Push a captured analysis to a central Lookyloo instance for shared repository storage.
    📍In the UI, open the capture details page, click Share › Push to another instance, and enter the target Lookyloo URL with valid credentials.
    • Adds allow_headed setting in config/generic.json to enable captures with a full (headed) browser instead of headless
    • Trigger CIRCL Passive DNS on IPs and hostnames automatically during analysis
    • Index IPs and TLDs with searchable indexes exposed in the UI
    • Link hostname and IP indexes together, visible on the UI for cross-referencing
    • Share direct links to IP, Hostname, Favicon modals from the UI

    +5 more show less

    • Push captured analyses to another Lookyloo instance via the UI or API
    • Use MISP Taxonomy (dark-web) as the default categorization scheme
    • Restrict modules to admin users only to limit third-party API token exposure
    • Enable full-text search on indexes where applicable for faster lookups
    • Optionally auto-submit .onion URLs to an AIL instance via configuration

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The RiskIQ module has been removed as the upstream service was killed by Microsoft.
27. v1.26.1 Oct 10, 2024 · release notes

    Lookyloo v1.26.1 adds pagination by capture timestamp, new TLDTLDThe rightmost label in a domain name (e.g., .com, .gov, .uk), maintained by IANA's root zone. Cyber tools filter or pivot on TLDs to scope scans, flag suspicious registrations, or classify traffic by geography or type. index, and optional JS disable during capture.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.26.1 https://github.com/Lookyloo/lookyloo.git
    # already have the repo? check out this version:
    $ git checkout v1.26.1

    • Adds new index for Top Level Domains (TLDs) to improve lookup speed
    • Allows paginating search results based on capture timestamp using the new index backend

    2 details in Everything

28. v1.26.0 Sep 17, 2024 · release notes

    Lookyloo v1.26.0 adds capture categorization, API retrieval by UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide., per-script control, and CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. headers.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.26.0 https://github.com/Lookyloo/lookyloo.git
    # already have the repo? check out this version:
    $ git checkout v1.26.0

    └──▷ TRY IT
    Remove a specific capture from Lookyloo using its UUID.
    copy

    $ curl -X DELETE https://lookyloo.example.com/api/v1/capture/<uuid>

    Access a specific capture directly via its UUID in the browser or API.
    📍https://lookyloo.example.com/capture/<uuid>
    • Adds categories feature to organize captures
    • Adds GET /api/v1/captures/category/<category> endpoint to retrieve UUIDsUUIDsA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. by category
    • Adds API capability to fetch a single capture via its UUID
    • Adds controller buttons to Start/Stop individual scripts per capture

    4 details in Everything

29. v1.25.0 Jul 3, 2024 · release notes

    Lookyloo v1.25.0 adds capture removal endpoint, FuzzImy hashing, PNG tree export, and simplified capture interface

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.25.0 https://github.com/Lookyloo/lookyloo.git
    # already have the repo? check out this version:
    $ git checkout v1.25.0

    └──▷ TRY IT
    Remove a specific capture from the index while preserving its files.
    copy

    $ curl -X GET "http://localhost:5000/captures/abc123/remove"

    Disable SRI validation for local development by updating the config file.
    json copy

    # In generic.json:
    {
      "sri_validation": false
    }

    • Adds FuzzImy hash generation based on HTML structure using CERT PL algorithm for rendered pages
    • Adds option to download the capture tree visualization as PNG
    • Adds simplified capture page UI without the standard options panel
    • Adds optional auto-report checkbox on the admin capture page

    4 details in Everything

30. v1.24.0 Mar 29, 2024 · release notes

    Lookyloo v1.24.0 adds captcha ID indexing, Shodan favicon correlation, admin-only capture indexing, and send_email API access

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.24.0 https://github.com/Lookyloo/lookyloo.git
    # already have the repo? check out this version:
    $ git checkout v1.24.0

    • Index favicons and correlate them to Shodan via MM3H hash
    • Search and index captcha IDs (reCaptcha, hCaptcha, Cloudflare)
    • [Admin Only] Index all captures in kvrocks instead of only public ones
    • Make send_email available from the API

    4 details in Everything

31. v1.23.0 Feb 5, 2024 · release notes

    Lookyloo v1.23.0 adds S3 archiving, CIRCL Passive DNS integration, and API-driven auto-reporting.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.23.0 https://github.com/Lookyloo/lookyloo.git
    # already have the repo? check out this version:
    $ git checkout v1.23.0

    • Archiving old captures to a S3 bucket enables offloading long-term storage for captured data (noted as handling well over 2M on production).

    1 detail in Everything

32. v1.22.0 Oct 17, 2023 · release notes

    Lookyloo v1.22.0 adds S3FS archival, gzip HARs, MISP export on file download, favicon fetching, and multiple MISP instance support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.22.0 https://github.com/Lookyloo/lookyloo.git
    # already have the repo? check out this version:
    $ git checkout v1.22.0

    • S3FS integration for archiving captures
    • HARHARAn HTTP Archive file, a JSON-format log of all network requests and responses captured by a browser's developer tools, used by cyber tools to replay, inspect, or analyze web traffic without re-running a live session. dumps stored in gzip archives instead of uncompressed format
    • New capability to export to MISP when a capture downloads a file (MISP Export on Download)
    • Ability to fetch downloaded files via the API
    • Fetch favicons using default URL and HTML content

    +1 more show less

    • Support for multiple MISP instances for submission and lookup

    6 details in Everything

33. v1.21.0 Jun 30, 2023 · release notes

    Lookyloo v1.21.0 adds configurable capture parameters and global proxy support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.21.0 https://github.com/Lookyloo/lookyloo.git
    # already have the repo? check out this version:
    $ git checkout v1.21.0

    └──▷ USE IT
    Configure a global proxy for all captures via the settings file.
    yaml copy

    # Set 'proxy' in your Lookyloo config file (e.g., /etc/lookyloo/config.yaml)
    # proxy: http://proxy.example.com:8080

    Specify capture parameters like locale and timezone when submitting a URL.
    📍# Via API or UI, specify: { url: https://example.com, locale: fr_FR, timezone: Europe/Paris, geo: {"lat": 48.8566, lon: 2.3522}, color_scheme: dark }
    • Allows passing timezone, geolocation coordinates, locale, and color scheme to a capture
    • Adds a proxy option in the settings to configure a global proxy

    2 details in Everything

34. v1.20.0 Jun 1, 2023 · release notes

    Lookyloo v1.20.0 adds API-driven capture comparison, Pandora submission, and auto-reporting capabilities

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.20.0 https://github.com/Lookyloo/lookyloo.git
    # already have the repo? check out this version:
    $ git checkout v1.20.0

    • Adds the ability to compare captures via the API
    • Enables submission of any URL format to Pandora (if available) through the tool
    • Allows automatic reporting to be triggered via the API
    • Adds a field in the monitoring form to set an email address for notifications

    4 details in Everything

35. v1.19.0 Mar 30, 2023 · release notes

    Lookyloo v1.19.0 adds email attachment for contacts and admin modal for capture tasks

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.19.0 https://github.com/Lookyloo/lookyloo.git
    # already have the repo? check out this version:
    $ git checkout v1.19.0

    └──▷ HOW TO FIND IT
    Administrators can now quickly manage problematic captures via the UI without CLI access.
    📍In the console, navigate to a specific capture page and use the new modal to select hide or rebuild.
    • Email notifications now attach contact details to facilitate takedown requests.
    • Admin-only modal added to trigger hide or rebuild tasks on specific captures.

    2 details in Everything

36. v1.18.0 Mar 1, 2023 · release notes

    Adds recurring capture monitoring, takedown API, and AAAA DNS support in Lookyloo v1.18.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.18.0 https://github.com/Lookyloo/lookyloo.git
    # already have the repo? check out this version:
    $ git checkout v1.18.0

    • monitoring subsystem (beta) triggers recurring captures for temporal comparison
    • New Takedown endpoint (/takedowns) gathering WHOIS/security.txt contacts for malicious URLs
    • AAAA DNS queries are now triggered during capture (previously A only)

    3 details in Everything

37. v1.17.0 Dec 29, 2022 · release notes

    Lookyloo v1.17.0 adds HARHARAn HTTP Archive file, a JSON-format log of all network requests and responses captured by a browser's developer tools, used by cyber tools to replay, inspect, or analyze web traffic without re-running a live session. file submission, offline capture storage, bulk status views, and download modals.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.17.0 https://github.com/Lookyloo/lookyloo.git
    # already have the repo? check out this version:
    $ git checkout v1.17.0

    └──▷ HOW TO FIND IT
    Submit a HAR file from another source for analysis within Lookyloo
    📍Use the UI to select Submit HAR file and upload the .har archive
    View all downloadable elements (HTML, JS, etc.) for a specific capture via the tree view
    📍Navigate to tree view -> Download capture elements
    • Supports submitting and viewing a HAR file captured externally via the UI
    • Implements temporary local storage of captures when the Lacus web-service is unreachable
    • Displays status updates for captures submitted in bulk
    • Adds a modal to list all downloadable contents for a capture from the tree view

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Poetry v1.3.0 or more recent is now required; upgrading will break if an older version remains installed.
38. v1.16.0 Oct 29, 2022 · release notes

    Adds remote_lacus configuration to .hacktron/config.yaml for external capture orchestration via Lacus

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.16.0 https://github.com/Lookyloo/lookyloo.git
    # already have the repo? check out this version:
    $ git checkout v1.16.0

    • config/generic.json: Adds remote_lacus.enable and remote_lacus.url config keys to route captures through an external Lacus instance

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !Requires poetry v1.2.0 or more recent. Run the following command to upgrade it: poetry self update
39. v1.15.0 Aug 25, 2022 · release notes

    Lookyloo v1.15.0 adds mobile device emulation, downloadable content submission to Pandora, and browser engine auto-selection.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.15.0 https://github.com/Lookyloo/lookyloo.git
    # already have the repo? check out this version:
    $ git checkout v1.15.0

    • Use pre-configured devices from Playwright (mobile only for now)
    • Download files when the URLs points to a downloadable content
    • Submit downloadable content to Pandora (if available)
    • Automatically select the most appropriate browser engine based on the user-agent

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Lookyloo requires Redis 7.0 or more decent.
40. v1.14.0 Aug 8, 2022 · release notes

    Lookyloo v1.14.0 adds file-based capture, RiskIQ Passive DNS integration, gzip HARHARAn HTTP Archive file, a JSON-format log of all network requests and responses captured by a browser's developer tools, used by cyber tools to replay, inspect, or analyze web traffic without re-running a live session. archives, and DoNotTrack header support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.14.0 https://github.com/Lookyloo/lookyloo.git
    # already have the repo? check out this version:
    $ git checkout v1.14.0

    • Support for RiskIQ Passive DNS (requires API key)
    • Compress (gzip) the HAR file in archived captures - saves a lot of disk space
    • Display SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination./TLS information available in the HAR dump from Playwright
    • Optional DoNotTrack HTTP header in capture
    • Display size of rendered page on hostnode popup

    5 details in Everything

41. v1.13.0 Jun 26, 2022 · release notes

    Lookyloo v1.13.0 revamps package generator for improved usability.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.13.0 https://github.com/Lookyloo/lookyloo.git
    # already have the repo? check out this version:
    $ git checkout v1.13.0

    • Revamped the package generator to be more usable.

    1 detail in Everything

42. v1.12.0 May 24, 2022 · release notes

    Lookyloo v1.12.0 adds Playwright-based captures and automatic capture de-duplication.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.12.0 https://github.com/Lookyloo/lookyloo.git
    # already have the repo? check out this version:
    $ git checkout v1.12.0

    • Adds Playwright as the capture engine instead of Splash, enabling instrumentation of reCaptcha detection.
    • Adds automatic de-duplication that skips identical capture requests triggered within 5 minutes.

    2 details in Everything

43. v1.11.0 Mar 31, 2022 · release notes

    Adds bulk capture from the web interface to trigger multiple captures at once.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.11.0 https://github.com/Lookyloo/lookyloo.git
    # already have the repo? check out this version:
    $ git checkout v1.11.0

    └──▷ HOW TO FIND IT
    Analyze a set of URLs simultaneously by queueing them together instead of submitting them one by one.
    📍In the Lookyloo web interface, select multiple URLs and trigger the capture action to run them concurrently.
44. v1.10.0 Dec 3, 2021 · release notes

    Lookyloo v1.10.0 adds Hashlookup integration, arbitrary HTTP headers/UA for captures, per-capture privacy default, CORSCORSA browser mechanism that lets a server declare which foreign origins may read its HTTP responses, enforced by the browser to block unauthorized cross-site requests from JavaScript. support, and resource hash API.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.10.0 https://github.com/Lookyloo/lookyloo.git
    # already have the repo? check out this version:
    $ git checkout v1.10.0

    • Adds Hashlookup integration to lookup IP hashes via the CIRCL service
    • Allows passing arbitrary HTTP headers to captures via the new capture configuration option
    • Allows passing arbitrary User-Agent strings to captures via the browser configuration option
    • Exposes an API endpoint to get hashes of all captured resources using any Python-supported algorithm
    • Adds default_public config setting to make captures private by default

    +1 more show less

    • Adds CORS settings configuration to enable JavaScript-based submissions from browser extensions

    6 details in Everything

45. v1.9.0 Sep 28, 2021 · release notes

    Lookyloo v1.9.0 adds Phishtank integration, a monitoring script, and URL re-capture.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.9.0 https://github.com/Lookyloo/lookyloo.git
    # already have the repo? check out this version:
    $ git checkout v1.9.0

    • Integration with Phishtank via Phishtank Lookup

    1 detail in Everything

46. v1.8.0 Aug 30, 2021 · release notes

    Lookyloo v1.8.0 adds urlscan.io integration, on-demand capture triggering, and an archival system for old captures.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.8.0 https://github.com/Lookyloo/lookyloo.git
    # already have the repo? check out this version:
    $ git checkout v1.8.0

    • Adds urlscan.io integration to enrich analysis results
    • Enables triggering a capture directly from the URL interface (issue #248)
    • Introduces configurable archiving for captures older than 6 months, moving them off the main index while retaining access via UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide.

    3 details in Everything

47. v1.7.0 Jul 21, 2021 · release notes

    Lookyloo v1.7.0 adds proxy support for captures, MISP instance lookup, and a major API overhaul.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.0 https://github.com/Lookyloo/lookyloo.git
    # already have the repo? check out this version:
    $ git checkout v1.7.0

    └──▷ TRY IT
    Send a capture request through an HTTP proxy by specifying the URL in the JSON body.
    copy

    $ curl -X POST https://lookyloo.circl.lu/api/v1/capture \
      -H 'Content-Type: application/json' \
      -d '{"url": "https://example.com", "proxy": "http://proxy.internal:8080"}'

    Configure log rotation for Lookyloo using the new sample configuration file in production deployments.
    📍# Add the following block to your Docker or systemd service environment vars # LOG_ROTATION_CONFIG=./logs/lookyloo_logging.conf
    • Adds proxy parameter to capture requests, enabling traffic routing through a configured proxy server
    • Migrates the underlying API framework to flask-restx, introducing new endpoints and request/response structures

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The API structure is overhauled due to the migration to flask-restx; existing API consumers must update their integration code to match the new endpoints and formats.
48. v1.6.0 May 21, 2021 · release notes

    Lookyloo v1.6.0 adds uWhoisd integration, async capture weighting, and in-memory index caching.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.0 https://github.com/Lookyloo/lookyloo.git
    # already have the repo? check out this version:
    $ git checkout v1.6.0

    • Adds priority and async_capture_processes config keys to weight capture priority and control concurrency
    • Adds optional integration of whois queries via uWhoisd for automated lookups
    • Enables in-memory indexing of captures via the webserver for faster index view loads

    3 details in Everything

49. v1.5.0 Apr 2, 2021 · release notes

    Lookyloo v1.5.0 adds context-preserving follow-up captures, a background API cache indexer, and a /search endpoint for hostnames, URLs, hashes, and cookies.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.0 https://github.com/Lookyloo/lookyloo.git
    # already have the repo? check out this version:
    $ git checkout v1.5.0

    └──▷ TRY IT
    Search for specific artifacts (hostnames, URLs, hashes, or cookie names) directly via the new /search entry point.
    copy

    $ curl 'https://<lookyloo-instance>/search?q=example.com&type=url'

    • Captures URLs found in an existing capture while keeping the context (cookies, user-agent, referer) your browser was in during subsequent captures
    • Runs a new background indexer so that captures queued via the API are automatically cached even if never opened in the browser
    • Enables searching for hostnames, URLs, hashes, and cookie names from the /search entry point

    3 details in Everything

50. v1.4.0 Feb 9, 2021 · release notes

    Adds direct MISP instance export and improved UI tooltips in Lookyloo v1.4.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.0 https://github.com/Lookyloo/lookyloo.git
    # already have the repo? check out this version:
    $ git checkout v1.4.0

    • Adds integration to export a capture directly to a pre-configured MISP instance
    • Adds more tooltips shown when the mouse goes over icons and different parts of the tree

    2 details in Everything

51. v1.3 Dec 24, 2020 · release notes

    Lookyloo v1.3 adds MISP export, modules for third-party services, resource marking, and config-based setup.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3 https://github.com/Lookyloo/lookyloo.git
    # already have the repo? check out this version:
    $ git checkout v1.3

    • Adds Export in MISP format capability to push findings to MISP instances
    • Adds a modules system to query third party services (SaneJS, VirusTotal, Phishing Initiative)
    • Adds support for marking specific resources as known or malicious via the investigation popup
    • Adds indexing of cookies and hashes of resources
    • Adds DNS resolution (IP and CNAMEs) capability

    +5 more show less

    • Enables configuration via config files
    • Adds a new update script
    • Adds statistics view for the whole instance
    • Adds Systemd templates for deployment
    • Distributes a Docker image

    10 details in Everything