noir

No entries match these filters. Clear filters

1. v1.5.0 Nov 2, 2026 · issue 128

   noir adds query verbs (noir trace, noir reach, noir query), native Windows and npm installs, Anthropic and Gemini AI providers, and new AI flags for streaming and key-file auth.

   └──▷ GET THIS VERSIONDockernpmgit

   Docker copy

   $ docker pull ghcr.io/owasp-noir/noir:1.5.0

   npm copy

   $ npm install -g @owasp-noir/noir@1.5.0

   git copy

   $ git clone --branch v1.5.0 https://github.com/owasp-noir/noir.git
   # already have the repo? check out this version:
   $ git checkout v1.5.0

   published under the project's GitHub account · signed build provenance · checked 2 Nov

   • Match a request to its route with noir trace, list routes that reach a file with noir reach FILE[:LINE], and filter by guard, sink, param, path or handler with noir query — all reading a saved report via --from or scanning live.
   • Control AI behaviour with new flags --ai-stream, --ai-key-file, and --ai-temperature, and attach per-endpoint review context using the new ai_context JSON Schema.
   • Use a native Anthropic provider or a Gemini preset alongside existing AI providers, with explicit provider errors when misconfigured.
   • TypeScript, TSX and Ruby now use their own tree-sitter grammars, improving ASTASTAn abstract syntax tree, a structured representation of parsed code. Tools inspect or transform this tree to understand expressions and statements rather than just matching text.-based parsing for NestJS-family decorators, Fastify, Feathers, tRPC, LoopBack, and Rails callbacks.
   • New detectionLarge repositories now scan faster — GitLab drops from 13s to 4.3s, vikunja from 15.6s to 2.0s, qdrant from 4.2s to 1.8s, and n8n peak memory from 669 MB to 410 MB.

   5 details in Everything

   • New integration npm package
   • New supported platform Native Windows build
2. docs update Oct 10, 2026 · issue 101

   Noir's --ai-context flag now documents bucket cross-linking, an untrusted-field contract, and a published JSON Schema at schemas/ai-context.schema.json.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Scan a repo for auth guards and sinks while keeping derived signals linked, then pipe the result to an LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. pipeline that validates against the published schema.
   copy

   $ noir scan . --ai-context=guards,sinks

   • Adds --ai-context=guards,sinks flag usage showing that derived signals (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ authz_absence) stay linked to their supporting buckets, and that selecting a signal keeps its evidence (e.g. ssrf keeps outbound_http sinks).
   • Publishes the --ai-context output shape as a JSON Schema at schemas/ai-context.schema.json, with "x-noir-untrusted": true on untrusted fields and an open vocabulary for entry values.
   • Every non-empty --ai-context output now carries "untrusted_fields": ["name", "path", "snippet"] to signal which fields come from the scanned repository and must be fenced from LLM instructions.
   • Adds --ai-context=guards,sinks flag usage showing that derived signals (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ authz_absence) stay linked to their supporting buckets, and that selecting a signal keeps its evidence (e.g. ssrf keeps outbound_http sinks).
   • Publishes the --ai-context output shape as a JSON Schema at schemas/ai-context.schema.json, with "x-noir-untrusted": true on untrusted fields and an open vocabulary for entry values.

   1 more in Everything

3. docs update Oct 10, 2026 · issue 101

   noir: Adds --ai-provider flag to select the AI backend (openai, xai, github, anthropic, gemini, or any OpenAI-compatible URL) for endpoint analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Audit only the files your static analyzer missed — send nothing to the LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. for routes already found, keeping token costs low.
   copy

   $ NOIR_AI_KEY=$(cat ~/.config/noir/openai.key) noir scan . --ai-provider openai --ai-model gpt-5.5 --ai-scope unmatched

   Preview exactly what would be sent to the AI — file list, request count, and token estimate — before committing to an expensive scan.
   copy

   $ noir scan . --ai-provider openai --ai-model gpt-5.5 --ai-key-file ~/.config/noir/openai.key --ai-dry-run

   Run a fully reproducible CI scan through a TLS-intercepting proxy using a private CA, capped at 50 AI requests, with a fixed seed for deterministic output.
   copy

   $ NOIR_AI_KEY=$(cat /run/secrets/openai_key) HTTPS_PROXY=http://proxy.internal:8080 SSL_CERT_FILE=/etc/ssl/corp-ca.pem noir scan . --ai-provider openai --ai-model gpt-5.5 --ai-seed 42 --ai-max-requests 50 --strict

   • Adds --ai-model flag to specify the model name sent to the chosen provider (e.g. gpt-5.5).
   • Adds NOIR_AI_KEY environment variable as an alternative way to supply the API key.

   2 details in Everything

4. docs update Oct 10, 2026 · issue 101

   noir: Adds glob-based file exclusion with path separator matching from scan base and directory skipping.

   └──▷ TRY IT
   Pass an AI API key from a file to avoid leaking it in the process list during a scan.
   copy

   $ noir --ai-key-file ~/.config/noir/ai.key -b ./myapp

   Cap concurrency to a fixed number of workers on a shared CI host instead of relying on CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. count detection.
   copy

   $ NOIR_CONCURRENCY=8 noir -b ./myapp

5. docs update Oct 10, 2026 · issue 101

   Noir AI analyzer gains dry-run, scope control, sensitive-file opt-in, proxy/CA support, and an automatic endpoint optimizer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Audit what noir would send to the AI before committing to a real scan — useful in CI to validate scope without incurring LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. costs.
   copy

   $ noir scan . --ai-provider openai --ai-model gpt-5.5 --ai-key-file ~/.config/noir/openai.key --ai-dry-run

   Focus the AI only on files the static analyzer missed, and cap spend at 50 requests, while keeping credentials files off the wire.
   copy

   $ noir scan . --ai-provider openai --ai-model gpt-5.5 --ai-key-file ~/.config/noir/openai.key --ai-scope unmatched --ai-max-requests 50

   Route AI traffic through a corporate TLS-intercepting proxy with a private CA, useful in air-gapped or heavily firewalled environments.
   copy

   $ HTTPS_PROXY=http://proxy.corp.example:8080 SSL_CERT_FILE=/etc/pki/corp-ca.pem NOIR_AI_KEY=<YOUR_API_KEY> noir scan . --ai-provider openai --ai-model gpt-5.5

   • Adds --ai-dry-run flag to list candidate files, request count, and token estimate without sending anything to the LLM — safe for CI auditing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds --ai-scope flag accepting all (default) or unmatched to restrict AI analysis to files the static analyzer did not already cover.
   • Adds --ai-include-sensitive flag to opt in to sending credentials files (.env*, *.pem, *.key, id_rsa*, .npmrc, *.tfvars, etc.) that are withheld by default.
   • Adds --ai-key-file flag to read the API key from a file (whitespace stripped), avoiding key exposure in the process list and shell history.
   • Adds --ai-temperature flag to set the sampling temperature for every AI request, with a lower default for deterministic CI runs; fixed-sampling models such as GPT-5 and the o-series ignore it.

   +5 more show less

   • Adds --ai-seed flag to send a sampling seed where the provider supports one (seed for OpenAI-compatible, options.seed for Ollama).
   • Adds --ai-no-optimize flag to skip the automatic LLM optimizer pass that normalizes path-parameter syntax and fixes parameter types after AI-only endpoint discovery.
   • Adds --ai-max-requests flag to cap the total AI HTTP requests per run (retries included); files left unanalyzed are reported as coverage gaps.
   • Supports HTTPS_PROXY, HTTP_PROXY, and NO_PROXY environment variables to route AI requests through an http:// proxy; loopback hosts always go direct.
   • Supports SSL_CERT_FILE environment variable to supply a custom CA bundle for providers or TLS-intercepting proxies signed by a private CA.

   10 details in Everything

6. docs update Oct 10, 2026 · issue 101

   Noir adds --ai-key-file PATH for secure AI key injection and exposes NOIR_CONCURRENCY to tune worker count.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Supply an AI API key from a file to keep it out of the process list and shell history.
   copy

   $ noir --ai-key-file /run/secrets/ai_api_key <target>

   Cap Noir to 8 workers on a shared CI host to avoid starving other jobs.
   copy

   $ NOIR_CONCURRENCY=8 noir <target>

   • Adds NOIR_CONCURRENCY environment variable to control the worker count (default: CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. count, clamped to 4–32).
   • Filtered exports retain cross-bucket context by keeping signals linked to their supporting evidence, with priority roll-up included when signals are selected explicitly.
   • Adds NOIR_CONCURRENCY environment variable to control the worker count (default: CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. count, clamped to 4–32).

   1 more in Everything

7. docs update Oct 10, 2026 · issue 100
   • New supported platform C web frameworks: CivetWeb, Mongoose, libmicrohttpd
   • New supported platform .NET web frameworks: ABP Framework, ASP.NET Core MVC, ASP.NET Core Minimal API, ASP.NET MVC, Carter, FastEndpoints, ServiceStack, System.Net.HttpListener, Wolverine.Http
   • New supported platform JavaScript/TypeScript web frameworks: AdonisJS, Apollo Server, Astro, Cloudflare Pages Functions, Egg.js, Elysia, Expo Router, Express, Fastify, Feathers, Fresh, Hapi, Hono, HonoX, Koa, NestJS, Netlify Functions, Next.js, Nitro, NuxtJS, Oak, Qwik City, React Router, Remix, Restify, SolidStart, SvelteKit, Vercel Functions
   • New supported platform Python web frameworks: AWS Lambda Powertools, Bottle, Chalice, CherryPy, Django, Django Ninja, Falcon, FastAPI, FastHTML, Flask, Frappe, Litestar, Masonite, Odoo, Pyramid, Quart, Robyn, Sanic, Starlette, Tornado, aiohttp, http.server
   • New supported platform Rust web frameworks: Actix Web, Axum, Dioxus, Gotham, Leptos, Loco, Poem, RWF, Rocket, Salvo, Tide, Warp, ntex
   • New supported platform Scala web frameworks: Akka HTTP / Pekko HTTP, Finatra, Play Framework, Scalatra, Tapir, ZIO HTTP, http4s
   • New supported platform TypeScript-specific frameworks: LoopBack, Midway, NestJS, TanStack Router, Ts.ED, Wasp, inversify-express-utils, routing-controllers, tRPC, tsoa
8. docs update Oct 10, 2026 · issue 100
   • New integration Apache Thrift specification support
   • New integration Apigee proxy bundle support
   • New integration HAProxy config support
   • New integration Hoppscotch specification support
   • New integration Hurl specification support
   • New integration KrakenD specification support
   • New integration Ocelot specification support
   • New integration Spring Cloud Gateway config support
   • New integration Thunder Client specification support
   • New integration Tyk API definition support
   • New integration YARP (C#) specification support
9. docs update Oct 10, 2026 · issue 100

   Noir adds framework and language detection for 60+ new targets including Apex, C web servers, Rust, Scala, and serverless platforms.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds Apex / Salesforce (REST, Aura, SOAP) as a supported language and framework target.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds ASP.NET Razor Pages / Blazor, ABP Framework, HotChocolate, WCF (WebGet/WebInvoke), and Wolverine.Http as .NET framework targets.
   • Adds Absinthe (Elixir) as a supported framework target.
   • Adds Encore (Go/TypeScript) as a supported framework target.
   • Adds Revel, Apache Camel, Spring Data REST, and Vaadin as JVMJVMThe Java Virtual Machine, a runtime maintained by Oracle (and implemented by others) that executes Java bytecode on any OS, giving cyber tools a portable, garbage-collected environment with a large ecosystem of libraries.-ecosystem framework targets.

   +3 more show less

   • Adds JavaScript/TypeScript framework targets: Egg.js, Expo Router, HonoX, Moleculer, Qwik City, React Router, SolidStart, inversify-express-utils, oRPC, routing-controllers, ts-rest, and tsoa.
   • Adds PHP framework targets: API Platform, Laravel Folio, Livewire, and Nextcloud.
   • Adds Python framework targets: AWS Lambda Powertools, Chalice, FastHTML, Frappe, Graphene, Odoo, and Strawberry GraphQL.

   8 details in Everything

10. docs update Oct 10, 2026 · issue 100
    • Updated supported platform Multi-language and framework support
11. docs update Oct 10, 2026 · issue 100
    • New supported platform Multi-language framework support
12. docs update Oct 9, 2026 · issue 098

    Noir's curl output format now includes -g to disable URL globbing, preserving path parameters like {id} in generated requests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds -g (disable URL globbing) flag to generated curl commands so that path parameters like {id} and wildcards are sent literally rather than interpreted by curl.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

13. docs update Oct 9, 2026 · issue 098
    • New supported platform C framework callee coverage: CivetWeb, Mongoose, libmicrohttpd
    • New supported platform JavaScript/TypeScript framework callee coverage
    • New supported platform Python framework callee coverage
    • New supported platform Rust framework callee coverage
    • New supported platform Scala framework callee coverage
    • New supported platform Additional JavaScript/TypeScript framework callee coverage
14. docs update Oct 9, 2026 · issue 098
    • New supported platform New language and framework support in Noir
15. docs update Oct 9, 2026 · issue 098
    • Updated supported platform Supported languages and frameworks
16. docs update Oct 9, 2026 · issue 098
    • Updated supported platform Multi-language framework coverage
17. docs update Oct 5, 2026 · issue 095
    • New supported platform JavaScript/TypeScript framework callee coverage
18. docs update Oct 5, 2026 · issue 095
    • New supported platform React Router framework support
19. docs update Oct 5, 2026 · issue 095

    Noir documents NOIR_CONCURRENCY env var for controlling worker count and clarifies filtered export context retention.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Supports NOIR_CONCURRENCY environment variable to set the worker count (default: CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. count, clamped to 4–32).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Filtered exports retain supporting evidence context for each selected signal, with cross-bucket priority roll-up included when signals are selected explicitly.
    • Supports NOIR_CONCURRENCY environment variable to set the worker count (default: CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. count, clamped to 4–32).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 more in Everything

20. docs update Oct 5, 2026 · issue 095
    • Updated supported platform Supported languages and frameworks
21. docs update Oct 5, 2026 · issue 095

    Adds Windows x86_64 native binary distribution for OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Noir, available as a self-contained noir.exe starting after v1.4.0.

    • New supported platformDistributes a self-contained noir-vX.Y.Z-windows-x86_64.exe binary for Windows x86_64, installable by renaming to noir.exe and adding to PATH.

    1 detail in Everything

22. docs update Oct 5, 2026 · issue 095
    • Updated supported platform Multi-language framework support
23. docs update Sep 28, 2026 · issue 088

    Noir now supports Gori as a DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. pipeline integration target alongside ZAP, Burp Suite, and Caido.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

24. docs update Sep 28, 2026 · issue 088

    Noir gains --diff-ref for git-based attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. diffing with --fail-on CI gating and markdown/SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. output formats⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Catch any route that dropped its auth requirement before merging — fail CI and write a markdown summary for the PR comment.
    copy

    $ noir scan . --diff-ref origin/main --fail-on auth-removed,added -f markdown-table -o diff.md

    Block pushes locally if any endpoint silently loses its auth tag, using a git pre-push hook.
    copy

    $ #!/bin/sh
    exec noir scan . --diff-ref origin/main --fail-on auth-removed --no-log

    Scope the attack-surface diff to a single service in a monorepo and emit JSON for downstream processing.
    copy

    $ noir scan ./services/billing --diff-ref origin/main -f json

    • Adds --diff-ref <revision> flag to noir scan to diff the current working tree's attack surface against any git revision (branch, tag, commit, or HEAD~1) without a second checkout.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds --fail-on flag accepting comma-separated categories (added, removed, changed, auth-removed) to exit with a non-zero code when the diff contains those categories, enabling CI gating on attack surface changes.
    • Supports -f markdown-table output for diffs, rendering a count table followed by routes that lost auth and separate tables for added, removed, and changed endpoints — suitable for pull request comments.
    • Supports -f sarif output for diffs, reporting added endpoints and new params as notes and lost-auth endpoints as warnings, for integration with code scanning tools.
    • Supports -f toml output for diffs; any other -f value falls back to the text diff with a warning.

    +2 more show less

    • Highlights auth tag removal (! auth tag removed) in diff output when an endpoint previously required login but no longer does, visible when running with -T / --use-taggers.
    • Exposes auth_removed, params_added, params_removed, tags_added, and tags_removed fields per endpoint in the structured changes array of diff output.
    • Adds --diff-ref <revision> flag to noir scan to diff the current working tree's attack surface against any git revision (branch, tag, commit, or HEAD~1) without a second checkout.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds --fail-on flag accepting comma-separated categories (added, removed, changed, auth-removed) to exit with a non-zero code when the diff contains those categories, enabling CI gating on attack surface changes.
    • Highlights auth tag removal (! auth tag removed) in diff output when an endpoint previously required login but no longer does, visible when running with -T / --use-taggers.
    • Exposes auth_removed, params_added, params_removed, tags_added, and tags_removed fields per endpoint in the structured changes array of diff output.

    3 more in Everything

25. docs update Sep 28, 2026 · issue 088

    Noir docs reveal Diff Mode for attack-surface comparison across git revisions with --diff-ref and --fail-on CI gating.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds --diff-ref flag to compare the current attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. against another path or git revision, reporting added, removed, and changed endpoints as well as lost auth coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds --fail-on flag to fail CI when Diff Mode detects regressions in the attack surface.
    • Adds a Tagger subsystem that applies contextual tags to discovered endpoints.
    • Adds a Deliver subsystem to push results directly to downstream tools such as Burp Suite, ZAP, and Elasticsearch.

    4 details in Everything

26. v1.4.0 Sep 27, 2026 · issue 088

    Noir v1.4.0 adds --diff-ref attack-surface diff mode with auth-removal detection, SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface./markdown reports, and ~1.75x faster full scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.0 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v1.4.0

    └──▷ TRY IT
    Detect endpoints added, removed, or stripped of authentication since the last release tag — fail CI when any auth_removed finding is present.
    copy

    $ noir scan . --diff-ref v1.3.1 --fail-on auth_removed

    • Adds --diff-ref to diff the attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. against a git revision, flagging changed endpoints and lost authentication as auth_removed; --fail-on exits with code 3 on matching findings, and the GitHub Action exposes diff_ref and fail_on inputs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Diff mode renders markdown and SARIF diff reports for CI consumption.
    • Merged endpoints now carry every contributing technology in details.technologies.
    • File upload params now emit multipart bodies in curl, httpie, PowerShell, OAS2, and OAS3 output; XML params emit application/xml bodies in OAS and Postman output.
    • Adds support for Express routes registered through a forwarding helper and the field form of the gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. google.api.http annotation.

    +1 more show less

    • Directory listing, file reads, passive-scan rules, and Go route parsing now run on worker threads in walk order, making default scans ~1.4x faster and full scans ~1.75x faster.
    • Adds --diff-ref to diff the attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. against a git revision, flagging changed endpoints and lost authentication as auth_removed; --fail-on exits with code 3 on matching findings, and the GitHub Action exposes diff_ref and fail_on inputs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Diff mode renders markdown and SARIF diff reports for CI consumption.

    4 more in Everything

27. docs update Sep 25, 2026 · issue 085

    Noir adds passive scanning, HTTP probing, AI provider integration, Elasticsearch/OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions. export, webhook export, and tagger controls⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Run a passive security scan against a codebase and surface only critical and high findings, then ship the endpoint catalog to a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. via webhook.
    copy

    $ noir -b ./myapp -u https://api.example.com --passive-scan --passive-scan-severity high --export-webhook https://siem.example.com/hooks/noir

    Probe live endpoints discovered in a Rails app through a local intercepting proxy, adding an auth header, while skipping TLS verification in a lab environment.
    copy

    $ noir -b ./rails-app -u https://staging.example.com --probe --probe-via http://127.0.0.1:8080 --probe-header 'Authorization: Bearer <token>' --tls-skip-verify

    Index all discovered endpoints into OpenSearch for long-term retention and dashboarding after scanning a Django codebase.
    copy

    $ noir -b ./django-app -u https://api.example.com --export-opensearch https://opensearch.example.com:9200

    • Adds -P, --passive-scan flag to enable passive security scanning of discovered endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds --passive-scan-severity LVL to set the minimum severity threshold for passive scan findings, accepting critical, high, medium, or low (default: high).
    • Adds --probe flag to fire live HTTP requests at discovered endpoints (requires -u for base URL).
    • Adds --probe-via <url> to route HTTP probes through a proxy URL.
    • Adds --probe-header VAL (repeatable) to attach custom headers to each probe request.

    +9 more show less

    • Adds --tls-skip-verify to skip TLS certificate verification for probe, export, and webhook operations.
    • Adds --export-es <url> to index discovered endpoints directly into Elasticsearch.
    • Adds --export-opensearch <url> to index discovered endpoints into OpenSearch (same wire format as --export-es).
    • Adds --export-webhook <url> to POST the full endpoint catalog as JSON to a webhook URL.
    • Adds --ai-provider flag to specify an AI provider prefix or full URL for AI-assisted analysis.
    • Adds --ai-model NAME to select the AI model and --ai-key KEY (or NOIR_AI_KEY env var) to supply the API key.
    • Adds --diff-path <path> to supply an older code version for noir diff output.
    • Adds -T, --use-all-taggers to activate all available taggers in a single pass.
    • Adds --use-taggers LIST to activate a specific comma-separated subset of taggers (see noir list taggers).

    14 details in Everything

28. docs update Sep 25, 2026 · issue 085

    noir now renders multipart file-upload requests in cURL, HTTPie, and PowerShell output formats when a file param is detected⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds multipart file-upload output for endpoints where a param_type: file field is discovered: cURL uses -F 'avatar=@avatar', HTTPie uses avatar@avatar, and PowerShell uses Get-Item -Path 'avatar' inside -Form @{…} — instead of the previous urlencoded/-Body shape that silently dropped file parts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports seeding the @filename / Get-Item path with a real file path via --pvalue 'any=avatar=./fixture.png' instead of the field-name placeholder.
    • Adds multipart file-upload output for endpoints where a param_type: file field is discovered: cURL uses -F 'avatar=@avatar', HTTPie uses avatar@avatar, and PowerShell uses Get-Item -Path 'avatar' inside -Form @{…} — instead of the previous urlencoded/-Body shape that silently dropped file parts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 more in Everything

29. docs update Sep 10, 2026 · issue 070

    Noir adds GraphQL Operations (GRAPHQL) to its list of supported specification formats.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds support for GRAPHQL (GraphQL Operations) as a recognized specification format.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

30. v1.3.1 Sep 2, 2026 · issue 063

    Noir v1.3.1 adds source line numbers for Rails/OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth./Spring routes, cross-file $ref resolution, and protocol badges in plain output.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.1 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v1.3.1

    • The plain text report now shows the protocol (kafka, mqtt, amqp, …) and an [internal] badge, matching what structured formats (-f json, -f yaml, etc.) already displayed.
    • Adds source line numbers for route declarations in Rails config/routes.rb, OpenAPI/Swagger operations, Symfony #[Route] attributes and routes.yaml, Vert.x, and Spring reactive RouterFunction routes — so findings point to the exact line.
    • OpenAPI documents over 10 MB now get their own 64 MB parsing budget instead of being silently dropped.

    3 details in Everything

31. docs update Sep 2, 2026 · issue 062

    Noir passive scan rules auto-update via --passive-scan-auto-update and custom rule sets load via --passive-scan-path

    └──▷ TRY IT
    Run a scan against a private or custom rule set instead of the bundled community rules — useful for internal compliance checks.
    copy

    $ noir scan /app -P --passive-scan-path ./my-rules/

    • Adds --passive-scan-auto-update flag to pull the latest community passive scan rules from the noir-passive-rules repository on startup.
    • Adds --passive-scan-path flag to point Noir at a private repository, local directory, or individual file as a replacement rule set for a given run; the flag can be repeated to load multiple sources.
    • Auto-provisions the community passive scan rule set to ~/.config/noir/passive_rules/ on first run when passive scanning is enabled, with no manual installation required.
    • Loads any .yml / .yaml files dropped into ~/.config/noir/passive_rules/ recursively, allowing custom rules to be mixed in alongside community rules.

    4 details in Everything

32. docs update Sep 2, 2026 · issue 062

    Noir adds --passive-scan-path flag to specify custom passive scan rules location, with offline/air-gapped support.

    └──▷ TRY IT
    Run Noir on an air-gapped host by pointing to a pre-populated rules directory instead of relying on automatic download.
    copy

    $ noir --passive-scan-path /opt/noir/passive_rules

    • Adds --passive-scan-path flag to specify a custom directory for passive scan rules, enabling air-gapped environments where automatic rule downloads are unavailable.
    • Passive scan rules default location is ~/.config/noir/passive_rules, loading up to 27 valid rules when present.

    2 details in Everything

33. docs update Sep 2, 2026 · issue 062

    Noir passive scan now accepts --passive-scan-path for fully offline, custom-rule runs from local directories

    └──▷ TRY IT
    Run a fully air-gapped passive scan against a codebase using only your own rule set, bypassing all bundled rule downloads.
    copy

    $ noir scan <BASE_PATH> -P --passive-scan-path /path/to/your/rules/

    • Adds --passive-scan-path <dir> flag to noir scan, which loads every *.yml/*.yaml rule file found recursively under the given directory, skips bundled rules entirely (no git or network access needed), and can be repeated — duplicate rule IDs across directories are deduplicated automatically.

    1 detail in Everything

34. docs update Sep 2, 2026 · issue 062

    Noir documents OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. output format with OAS 2.0OAS 2.0The OpenAPI Specification version 2.0 (formerly Swagger), a JSON/YAML schema for describing REST APIs; tools use it to auto-generate clients, servers, and documentation from a single contract file. and 3.x support, including HTTP QUERY route auto-upgrade to 3.2.0

    └──▷ TRY IT
    Generate a Swagger 2.0 spec from a codebase when your toolchain requires OAS 2.0 compatibility.
    copy

    $ noir -f oas2 -b <path>

    • Supports both OAS 2.0 (Swagger) and OAS 3.x output formats; use -f oas2 to produce Swagger 2.0 shape where body parameters are emitted as in: formData / in: body entries and cookies ride as a Cookie header.
    • Emits OpenAPI 3.0.3 documents by default; automatically upgrades to 3.2.0 when a scan discovers an HTTP QUERY route, since OAS 3.0.x has no query operation.
    • Maps discovered parameters to OpenAPI semantics: headers, cookies, path, and query parameters are emitted under parameters; form and JSON bodies become a requestBody with the matching media type (application/x-www-form-urlencoded or application/json).

    3 details in Everything

35. docs update Sep 2, 2026 · issue 062

    Noir adds CLI framework detection for Go, Python, Rust, JavaScript, Ruby, C#, Java, Kotlin, PHP, C++, Swift, Nim, Haskell, Scala, Zig, Clojure, Lua, Perl, and Groovy.

    • Adds endpoint extraction support for Go CLI frameworks: cobra (with viper env), urfave/cli, pflag, go-arg, go-flags, kong, kingpin, mitchellh/cli.
    • Adds endpoint extraction support for Python CLI frameworks: click, typer, fire, docopt, Abseil (absl-py), Cleo.
    • Adds endpoint extraction support for Rust CLI frameworks: clap (derive), structopt, argh, getopts.
    • Adds endpoint extraction support for Node.js/JavaScript CLI frameworks: commander, yargs, cac, sade, meow, minimist, arg, command-line-args, getopts, citty.
    • Adds endpoint extraction support for Ruby CLI frameworks: Thor, GLI, Slop, TTY::Option, commander, Optimist, Clamp, dry-cli.

    +14 more show less

    • Adds endpoint extraction support for C# CLI frameworks: System.CommandLine, CommandLineParser, CliFx, Spectre.Console.Cli, McMaster.Extensions.CommandLineUtils, Cocona.
    • Adds endpoint extraction support for Java CLI frameworks: picocli, args4j, JCommander, commons-cli, airline, JOpt Simple.
    • Adds endpoint extraction support for Kotlin CLI frameworks: clikt (with envvar support), kotlinx-cli, picocli.
    • Adds endpoint extraction support for PHP CLI frameworks: Symfony Console, Laravel Artisan (using $signature), Robo, WP-CLI.
    • Adds endpoint extraction support for C++ CLI frameworks: CLI11, getopt/getopt_long, cxxopts, boost::program_options, gflags, Abseil Flags, p-ranav/argparse.
    • Adds endpoint extraction support for Swift CLI frameworks: swift-argument-parser, SwiftCLI.
    • Adds endpoint extraction support for Nim: Optimus.
    • Adds endpoint extraction support for Haskell CLI frameworks: optparse-applicative, cmdargs, System.Console.GetOpt, turtle.
    • Adds endpoint extraction support for Scala CLI frameworks: scopt, decline, mainargs, Scallop, twitter-util.
    • Adds endpoint extraction support for Zig CLI frameworks: zig-clap, zig-cli, zig-args, yazap.
    • Adds endpoint extraction support for Clojure CLI frameworks: clojure.tools.cli, cli-matic, babashka.cli, environ.
    • Adds endpoint extraction support for Lua CLI frameworks: argparse, lua_cliargs.
    • Adds endpoint extraction support for Perl CLI frameworks: App::Cmd, Getopt::Long::Descriptive, MooX::Options.
    • Adds endpoint extraction support for Groovy CLI frameworks: CliBuilder, picocli, commons-cli, JCommander.

    19 details in Everything

36. docs update Sep 2, 2026 · issue 062

    Noir adds -f adb and -f simctl output formats to launch discovered mobile endpoints directly on Android and iOS devices.

    └──▷ TRY IT
    Generate ADBADBAndroid Debug Bridge, a command-line tool maintained by Google that lets a host machine communicate with an Android device over USB or TCP, giving cyber tools shell access, file transfer, and app control. launch commands for all discovered Android deep-link endpoints in an APK, ready to run on a connected device.
    copy

    $ noir -s <target> -f adb

    Generate simctl launch commands for all discovered iOS URL scheme endpoints, ready to run against an iOS simulator.
    copy

    $ noir -s <target> -f simctl

    • Adds -f adb output format to emit ready-to-run ADB device commands for launching discovered Android app endpoints.
    • Adds -f simctl output format to emit ready-to-run simctl device commands for launching discovered iOS app endpoints.
    • Mobile endpoints are included in structured inventory outputs (JSON, JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory., YAML, TOML, SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface., Markdown, mermaid, HTML) and Elasticsearch/webhook exports, but excluded from HTTP-shaped formats (cURL, HTTPie, PowerShell, OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. 2.0/3.0, Postman, and active probe/proxy delivery).

    3 details in Everything

37. docs update Sep 2, 2026 · issue 062

    Noir adds --no-spinner flag and -f json/yaml format option to list techs, plus flexible global flag placement

    └──▷ TRY IT
    Dump the full list of supported technologies as JSON to pipe into jq or other tooling.
    copy

    $ noir list techs -f json

    Run noir in CI where a spinner would corrupt log output — disable it while keeping all normal logs.
    copy

    $ noir --no-spinner list techs

    • Adds -f format flag to noir list techs accepting text (default), json, or yaml for machine-readable output.
    • Adds --no-spinner global flag to disable the loading spinner while preserving normal log output.
    • Global flags like --no-color can now be placed on either side of the subcommand verb (e.g., noir --no-color list techs or noir list techs --no-color).

    3 details in Everything

38. docs update Aug 19, 2026 · issue 050

    Noir adds an errors key to JSON/YAML/SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. output and a --strict flag to signal degraded scans.

    └──▷ TRY IT
    Fail CI when any analyzer was skipped or errored, while still capturing the full JSON endpoint report for further processing.
    copy

    $ noir scan . -f json --no-log --strict > endpoints.json

    • Adds an errors key to JSON output that records per-tech analyzer failures and skipped files, distinguishing an empty result from an analyzer that never ran.
    • Skipped files are tallied per tech with up to five example paths rather than one entry each, preventing a broken checkout from flooding the report.
    • Propagates the errors key to -f yaml output and maps it to runs[0].invocations[0].executionSuccessful in -f sarif output.
    • Adds --strict flag to exit with code 2 after a degraded scan (analyzer failure or skipped files), writing the report before exiting.

    4 details in Everything

39. docs update Aug 19, 2026 · issue 050

    Noir adds 12 new language/framework targets: ServiceStack, Kratos, Helidon MP/SE, Feathers, Oak, Sails.js, Phalcon, CherryPy, Masonite, Padrino, and LoopBack

40. docs update Aug 19, 2026 · issue 050

    Noir adds --strict flag to exit with code 2 when any analyzer fails or skips a file

    • Adds --strict flag that exits with code 2 if any analyzer failed or skipped a file during a scan, while still reporting all collected results — enables CI pipelines to catch incomplete scans.

    1 detail in Everything

41. v1.3.0 Aug 18, 2026 · issue 050

    Noir v1.3.0 adds HTTP QUERY method (RFC 10008) support, 11 new framework analyzers, and scan-integrity reporting with --strict.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.0 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v1.3.0

    └──▷ TRY IT
    Fail CI when any analyzer errors or file is skipped — catches silent coverage gaps in regulated pipelines.
    copy

    $ noir -b <source_dir> --strict

    • Adds --strict flag to exit non-zero when any analyzer fails or file is skipped, surfacing scan-integrity failures that were previously silently dropped.
    • Adds end-to-end support for the HTTP QUERY method (RFC 10008) across ~24 frameworks including Express, Fastify, Hono, NestJS, Flask, aiohttp, Rails, Laravel, Phoenix/Plug, Echo, Fiber, Go net/http, axum, Ktor, http4k, Micronaut, Vert.x, JAX-RS/Quarkus/Dropwizard, ASP.NET Core, and Kemal — including OAS3 serialization and HTML report rendering.
    • Adds 11 new framework analyzers: Oak (Deno), Feathers.js, Sails.js, LoopBack 4, CherryPy, Masonite, Padrino, Phalcon, Helidon, ServiceStack, and Kratos.
    • Recovers iOS deep-link routes that were previously missed during config-only scanning.
    • Failed analyzers and skipped files are now reported in scan output instead of being silently dropped.

    5 details in Everything

42. docs update Aug 12, 2026 · issue 043

    Noir adds live endpoint probing with proxy support and export to Elasticsearch, OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions., and webhooks

    └──▷ TRY IT
    Intercept all probed endpoint traffic in Burp Suite to inspect or replay requests without sending them directly.
    copy

    $ noir scan ./source -u http://localhost:3000 --probe --probe-via http://localhost:8080

    Override a path placeholder value so probes hit a real record ID rather than the default filler.
    copy

    $ noir scan ./source -u http://localhost:3000 --probe --set-pvalue-path id=42

    Ship the discovered endpoint catalog to a managed Elasticsearch cluster with API key authentication.
    copy

    $ noir scan ./source --export-es https://my.cloud.es.io/noir/_doc \
      --probe-header "Authorization: ApiKey <base64-key>"

    • Adds --probe-via flag to route probed endpoints through a Burp/ZAP intercepting proxy; requires an explicit port (e.g. http://localhost:8080) — a portless URL is rejected.
    • Adds --set-pvalue-path flag to override path placeholder values used during probing (e.g. id=42), applying to all HTTP verbs.
    • Adds --export-es URL to POST the full endpoint catalog to an Elasticsearch index as a single document; portless http:// defaults to port 9200, portless https:// defaults to 443.
    • Adds --export-opensearch URL to POST the endpoint catalog to an OpenSearch cluster using the same wire protocol as the Elasticsearch export.
    • Adds --export-webhook URL to POST the endpoint catalog as a single JSON document (fields: endpoints, endpoint_count, noir_version) to any HTTP receiver, including Slack, Discord, Zapier, or custom endpoints.

    +2 more show less

    • Adds --tls-skip-verify flag to disable TLS certificate verification for probe and export requests against self-signed internal hosts; --probe-via always skips TLS verification automatically.
    • Adds --probe-header support for authenticating export destinations (--export-es, --export-webhook) in addition to probe requests; headers are withheld from endpoints whose host differs from --url, with noir logging the withheld host.

    7 details in Everything

43. docs update Aug 4, 2026 · issue 035

    Noir AI power adds timeout, connect-timeout, and raw-log env vars with automatic retry on rate limits

    • Adds NOIR_AI_TIMEOUT environment variable to set the seconds Noir waits for a provider response (default: 300).
    • Adds NOIR_AI_CONNECT_TIMEOUT environment variable to set the seconds Noir waits for the connection itself (default: 10).
    • Adds NOIR_ACP_RAW_LOG environment variable — set to 1 to expose raw ACP and agent stderr logs for debugging.
    • AI requests that time out, hit a rate limit (HTTP 429), or encounter a transient gateway error are automatically retried up to three times with backoff, honoring the Retry-After header when the provider sends it.

    4 details in Everything

44. v1.2.0 Jul 19, 2026 · issue 020

    Noir v1.2.0 adds CLI app surface detection, 9 stdlib HTTP servers, schema-driven APIs, enterprise legacy stacks, and major perf gains.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.0 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v1.2.0

    • Detects CLI application attack surfacesattack surfacesThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. (argv, flags, env vars) across 17 languages and 40+ libraries including Cobra, Click, clap, Commander, Thor, and picocli.
    • Adds built-in HTTP server analyzers for Go (net/http), Python (http.server), Node (node:http), Java (com.sun.net.httpserver), C# (HttpListener), Ruby (WEBrick), Crystal, Dart, and Zig.
    • Adds schema-generated API analyzers for Strapi, Directus, Payload CMSCMSA web content management system for creating and managing digital content without writing code directly; cyber tools use CMS platforms to host documentation, portals, or reporting dashboards quickly., Supabase/PostgREST, Hasura, and Appwrite — extracting routes and params from schema files rather than source routes.
    • Adds enterprise legacy stack support: CFML/ColdFusion, Classic ASP, ASP.NET WebForms, and CFML frameworks Taffy, ColdBox, Wheels, and FW/1.
    • Adds BEAM language support: Erlang (Cowboy, Elli) and Gleam (Wisp).

    +9 more show less

    • Adds PHP CMS/platform analyzers for WordPress (REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services., admin-ajax, admin-post), Drupal (*.routing.yml), and Magento (Web API + MVC controller routes).
    • Adds Django Ninja (Python) and Plumber (R) framework analyzers.
    • Adds Terraform/OpenTofu analyzer to extract AWS API Gateway v1/v2 routes from .tf HCL and .tf.json files, resolved module-wide.
    • Adds realtime/event endpoint detection for SignalR, Socket.IO, Phoenix Channels, and Action Cable.
    • Adds OpenRPC and .http/.rest request file (VS Code REST Client, JetBrains HTTP Client) specification analyzers.
    • Adds machine-readable output for noir list and documents noir cache purge.
    • Adds Claude Sonnet 5, Grok 4.5, and GPT-5.6 to the AI provider token map.
    • Redesigned HTML report (-f html) with dark-tech theme, semantic method/severity colors, path grouping, table view, and copy URL/curl actions.
    • Codebase-wide performance sweep eliminates O(n²) scans, adds precompiled regex unions, and memoizes tree-sitter results — delivering order-of-magnitude speedups (e.g., F#/Giraffe 31.7s → 1.1s, Servant 101s → 4ms).

    14 details in Everything

45. v1.2.0 Jul 19, 2026 · issue 004

    Noir v1.2.0 adds CLI app surface detection, 9 stdlib HTTP servers, schema-driven APIs, enterprise legacy stacks, and major perf gains.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.0 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v1.2.0

    • Detects CLI application attack surfacesattack surfacesThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. (argv, flags, env vars) across 17 languages and 40+ libraries including Cobra, Click, clap, Commander, Thor, and picocli.
    • Adds built-in HTTP server analyzers for Go (net/http), Python (http.server), Node (node:http), Java (com.sun.net.httpserver), C# (HttpListener), Ruby (WEBrick), Crystal, Dart, and Zig.
    • Adds schema-generated API analyzers for Strapi, Directus, Payload CMSCMSA web content management system for creating and managing digital content without writing code directly; cyber tools use CMS platforms to host documentation, portals, or reporting dashboards quickly., Supabase/PostgREST, Hasura, and Appwrite — extracting routes and params from schema files rather than source routes.
    • Adds enterprise legacy stack support: CFML/ColdFusion, Classic ASP, ASP.NET WebForms, and CFML frameworks Taffy, ColdBox, Wheels, and FW/1.
    • Adds BEAM language support: Erlang (Cowboy, Elli) and Gleam (Wisp).

    +9 more show less

    • Adds PHP CMS/platform analyzers for WordPress (REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services., admin-ajax, admin-post), Drupal (*.routing.yml), and Magento (Web API + MVC controller routes).
    • Adds Django Ninja (Python) and Plumber (R) framework analyzers.
    • Adds Terraform/OpenTofu analyzer to extract AWS API Gateway v1/v2 routes from .tf HCL and .tf.json files, resolved module-wide.
    • Adds realtime/event endpoint detection for SignalR, Socket.IO, Phoenix Channels, and Action Cable.
    • Adds OpenRPC and .http/.rest request file (VS Code REST Client, JetBrains HTTP Client) specification analyzers.
    • Adds machine-readable output for noir list and documents noir cache purge.
    • Adds Claude Sonnet 5, Grok 4.5, and GPT-5.6 to the AI provider token map.
    • Redesigned HTML report (-f html) with dark-tech theme, semantic method/severity colors, path grouping, table view, and copy URL/curl actions.
    • Codebase-wide performance sweep eliminates O(n²) scans, adds precompiled regex unions, and memoizes tree-sitter results — delivering order-of-magnitude speedups (e.g., F#/Giraffe 31.7s → 1.1s, Servant 101s → 4ms).

    14 details in Everything

46. v1.1.0 Jun 15, 2026 · release notes

    Noir v1.1.0 adds mobile deep-link analysis, Zig framework support, OAS security-scheme extraction, seven new endpoint taggers, and -f adb/-f simctl output formats.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.0 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v1.1.0

    └──▷ TRY IT
    Launch mobile entry point analysis directly for Android using ADBADBAndroid Debug Bridge, a command-line tool maintained by Google that lets a host machine communicate with an Android device over USB or TCP, giving cyber tools shell access, file transfer, and app control..
    copy

    $ noir scan -f adb <path_to_source>

    Launch mobile entry point analysis directly for iOS using simctl.
    copy

    $ noir scan -f simctl <path_to_source>

    • -f adb and -f simctl output formats to launch Android and iOS mobile entry points directly
    • New framework analyzers for Zig (Jetzig, Zap, httpz, Tokamak) and updated support for C++, Go, Lua, Dart, PHP, Perl, Clojure, Java, and C# frameworks
    • Mobile analyzer detecting Android manifest and iOS Info.plist/entitlements deep-link entry points linked to handler code
    • New specification analyzers for Kamal (deploy.yml), Apache httpd, nginx, and Kubernetes Ingress
    • OAS2/OAS3 security-scheme parameter extraction emitting API key, OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs., and HTTP auth schemes as endpoint parameters

    +3 more show less

    • New endpoint taggers: pii, admin, payment, webhook, crypto, debug, api_docs, and account_recovery
    • Added claude-opus-4-8, claude-fable-5, claude-mythos-5, and grok-build-0.1 to the AI provider token map
    • Structural miniparsers for PHP (PhpLexer), C# (CSharpLexer), and Scala (ScalaLexer) to cut false positives/negatives in code/string-aware scanning

    8 details in Everything

47. v1.0.0 May 24, 2026 · release notes

    Noir v1.0.0 introduces verb-centric CLI (noir scan, list, cache), AI context filtering (--ai-context), and new probe/export flags.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.0 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v1.0.0

    └──▷ USE IT
    Run endpoint scanning with specific parameter values for different types.
    shell copy

    noir scan --pvalue query=test --pvalue cookie=123 ./app

    Filter the emitted AI context to only include sinks and validators.
    shell copy

    noir scan --ai-context=sinks,validators ./app

    Export findings to a custom webhook endpoint.
    shell copy

    noir scan --export-webhook https://hooks.example.com/noir ./app

    • Adds verb-based CLI structure with subcommands: scan, list, cache, config, rules, completion, version, help
    • Adds --pvalue TYPE=VAL flag to specify parameter values by type for endpoint scanning
    • Adds --include LIST flag to toggle enrichment categories (path, techs, callee) in output
    • Adds --ai-context[=LIST] flag to filter emitted AI context categories (guards, sinks, validators, signals, callee)
    • Adds --no-color flag and NO_COLOR environment variable support across all subcommands

    +4 more show less

    • Adds Elvish shell completion support via noir completion elvish
    • Adds JSON output fields callees (1-hop call graph) and ai_context (per-endpoint AI context)
    • Bundles noir-passive-rules snapshot in Docker image at /opt/noir/passive_rules/ for offline -P scanning
    • Introduces PROBE family flags (--probe, --probe-via) and EXPORT family flags (--export-es, --export-opensearch, --export-webhook)

    9 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Deprecated --ollama URL and --ollama-model NAME flags removed (use --ai-provider ollama instead)
48. v0.30.0 May 3, 2026 · release notes

    Adds Tree-sitter query API for declarative detectors, --exclude-path glob filter, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. endpoint tagger

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.30.0 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v0.30.0

    └──▷ BREAKING ON UPGRADE

    • !Retired legacy Java/Kotlin miniparser/minilexer; analyzers for Spring, Armeria, Ktor, and Flask now use tree-sitter
49. v0.29.0 Mar 28, 2026 · release notes

    Noir v0.29.0 adds support for Salvo, Hono, Nitro.js, httprouter, GoFrame, gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. spec analysis, and the NOIR_PARSER_MAX_DEPTH env var.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.29.0 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v0.29.0

    └──▷ USE IT
    Limit how deep the parser follows imports to prevent excessive resource usage or cycles in complex codebases.
    shell copy

    NOIR_PARSER_MAX_DEPTH=50 noir scan ./target

    • NOIR_PARSER_MAX_DEPTH environment variable to cap import-following depth
    • gRPC specification analyzer and detector
    • Salvo (Rust) framework support
    • Hono (Node.js) framework support
    • Nitro.js framework support

    +3 more show less

    • httprouter (Go) framework support
    • GoFrame (Go) framework support
    • Kemal namespace and mount routing support

    8 details in Everything

50. v0.28.0 Feb 22, 2026 · release notes

    noir v0.28.0 introduces AI Agent Mode for autonomous discovery and ACP integration for local agents

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.28.0 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v0.28.0

    └──▷ USE IT
    Run autonomous endpoint discovery on an application directory using the new AI agent workflow.
    shell copy

    noir -b ./myapp --ai-agent

    Analyze a target using a local ACP agent named codex without needing API keys.
    shell copy

    noir -b ./myapp --ai-provider=acp:codex

    • --ai-agent flag to enable iterative tool-callingtool-callingA model's ability to answer with a structured request to run a named function or API, which the application executes and returns. It is how agents take actions. AI workflow with subtools like list_directory, read_file, grep, and semantic_search.
    • --ai-provider=acp:<name> argument to analyze targets using locally configured ACP agents without external API keys.
    • Enhanced analyzer support for Cross-file Express.js routers.

    3 details in Everything

51. v0.27.0 Jan 15, 2026 · release notes

    NOIR v0.27.0 adds NuxtJS/TanStack Router/Swift detectors, TOML output, and new tech-scope flags

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.27.0 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v0.27.0

    └──▷ USE IT
    Run the scanner using only the NuxtJS detector to focus on Vue-based endpoints.
    shell copy

    noir scan --only-techs nuxtjs

    Export analysis results as TOML for easier parsing in CI pipelines.
    shell copy

    noir scan -f toml

    Include all technology detection data in the output regardless of default settings.
    shell copy

    noir scan --include-techs

    • --include-techs and --only-techs flags added to the CLI to control technology detection scope.
    • technology field added to detailed endpoint information output.
    • Added TOML output format via -f toml flag.
    • New NuxtJS detector and analyzer capability.
    • New TanStack Router detector and analyzer for TypeScript projects.

    +3 more show less

    • Swift Hummingbird detector and analyzer now available.
    • Swift Kitura detector and analyzer now available.
    • Java & Scala Play analyzer now supports body, header, and cookie parameters.

    8 details in Everything

52. v0.26.0 Dec 20, 2025 · release notes

    noir v0.26.0 adds Postman, HTML, PowerShell output formats, new taggers, and expanded framework support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.26.0 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v0.26.0

    └──▷ USE IT
    Generate a Postman collection for import into your test environment.
    shell copy

    noir -f postman <url_or_file>

    Create an HTML report for sharing with non-technical stakeholders.
    shell copy

    noir -f html <target>

    Output commands to replay requests in PowerShell without external converters.
    shell copy

    noir -f powershell <target>

    • -f postman flag enables Postman Collection v2.1.0 output format
    • -f html flag enables HTML output format
    • -f powershell flag enables PowerShell Invoke-WebRequest output format
    • Added new GraphQL, JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store., and FileUpload taggers for detecting specific request types
    • Expanded detector/analyzer support for Scala (Scalatra, Play, Akka), Swift (Vapor), TypeScript (NestJS), and C# ASP.NET Core MVC frameworks

    5 details in Everything

53. v0.25.1 Nov 16, 2025 · release notes

    Adds OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. logo to docs footer and token limits for new AI models; expands ASP.NET MVC analyzer for attribute routing

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.25.1 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v0.25.1

    • Expand ASP.NET MVC analyzer to support attribute routing and parameter binding

    1 detail in Everything

54. v0.25.0 Nov 8, 2025 · release notes

    Adds SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. output, Postman Collection JSON, expanded parameter types for more frameworks, and multiple -b flags.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.25.0 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v0.25.0

    └──▷ TRY IT
    Export results to SARIF for integration with code scanning platforms like GitHub or GitLab.
    copy

    $ noir scan --sarif ./my-app

    Analyze changes relative to two different base commits in one pass.
    copy

    $ noir scan -b main -b develop-branch ./my-app

    • --sarif flag added to export findings in SARIF format
    • --postman flag added to export API specs as a Postman Collection JSON file
    • -b / --base flag now accepts multiple values for tracking changes across several base commits

    3 details in Everything

55. v0.24.0 Sep 19, 2025 · release notes

    Adds --passive-scan-severity, GitHub Action support, SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation, and new framework detectors in Noir v0.24.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.24.0 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v0.24.0

    └──▷ USE IT
    Run a passive scan targeting only high and critical severity issues, skipping the automatic rule update check for offline environments.
    shell copy

    noir passive-scan --passive-scan-severity high --passive-scan-no-update-check <target>

    Configure CI/CD to use the new official GitHub Action for automated scanning.
    shell copy

    - uses: actions/checkout@v3
    - uses: owasp-noir/action@v1
      with:
        target: '<target>'

    • Adds --passive-scan-severity CLI flag to set minimum severity level for passive scans
    • Adds --passive-scan-auto-update and --passive-scan-no-update-check flags to control automatic passive scan rule updates
    • Adds official OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Noir GitHub Action integration
    • Adds SBOM (Software Bill of MaterialsSoftware Bill of MaterialsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue.) generation support
    • Adds support for 17 new detectors/analyzers including Marten, Grip, Amber, Plug, Go-Zero, FastHTTP, Mix, Vert.x, Next.js, Ktor, Symfony, Laravel, Tornado, Sanic, Gotham, Tide, and Warp

    +1 more show less

    • Adds --cache-disable and --cache-clear flags to control LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. cache behavior

    6 details in Everything

56. v0.23.1 Aug 18, 2025 · release notes

    Adds Method and Method:URL options to Matchers and Filters

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.23.1 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v0.23.1

57. v0.23.0 Aug 16, 2025 · release notes

    Adds Loco, rwf, and FeignClient detectors; mermaid output for endpoints (-f mermaid); Express dynamic path support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.23.0 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v0.23.0

    └──▷ TRY IT
    Export discovered endpoints as a Mermaid mindmap diagram instead of standard formats.
    copy

    $ noir scan -f mermaid <target>

    • Added -f mermaid to output endpoint discovery as a Mermaid mindmap
    • Added Loco framework detector and analyzer
    • Added rwf detector and analyzer
    • Added FeignClient interface analysis
    • Recognized router.all in Express Endpoint Detection for Dynamic Paths

    5 details in Everything

58. v0.22.0 Jun 21, 2025 · release notes

    Adds .graphql file analyzer and Koa.js detector/analyzer to noir.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.22.0 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v0.22.0

    • feat: Add detector and analyzer for Koa.js adds the new detector and analyzer capabilities for Koa.js applications
    • Add .graphql file analyzer enables scanning of GraphQL schema files

    2 details in Everything

59. v0.21.1 May 22, 2025 · release notes

    Adds --ai-max-token flag and AI token limit configuration to control LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. token usage

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.21.1 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v0.21.1

    └──▷ USE IT
    Limit LLM token usage to 5000 tokens during code analysis to prevent excessive API costs or timeouts.
    shell copy

    noir analyze --ai-max-token 5000

    • Adds --ai-max-token CLI flag for controlling the maximum number of tokens the LLM can use during analysis
    • Adds a new configuration key for setting the AI token limit in the noir config file

    2 details in Everything

60. v0.21.0 Apr 7, 2025 · release notes

    Adds Fastify detector and router-based route handling for Express and Restify in noir v0.21.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.21.0 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v0.21.0

    • Added Fastify detector and analyzer with TypeScript support

    1 detail in Everything

61. v0.20.0 Mar 1, 2025 · release notes

    Noir v0.20.0 adds AI provider flags, local LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. support (Ollama/vLLM), and .http file analysis.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.20.0 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v0.20.0

    • Adds --ai-provider, --ai-model, and --ai-key CLI flags to control AI integration sources and credentials
    • Enables local LLM support for Ollama, LM Studio, and vLLM as AI providers
    • Adds intellij .http file analysis capability (FileAnalyzer)
    • Adds golang chi framework detector and analyzer

    4 details in Everything

62. v0.19.0 Jan 19, 2025 · release notes

    noir v0.19.0 adds AI Analyzer with LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. integration and ZAP Site Tree Analyzer

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.19.0 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v0.19.0

    • Adds AI Analyzer with LLM integration for vulnerability analysis
    • Adds ZAP Site Tree Analyzer for enhanced site tree analysis

    2 details in Everything

63. v0.18.3 Nov 17, 2024 · release notes

    Adds completion:check Rake task and refines --list-techs output

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.18.3 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v0.18.3

    └──▷ TRY IT
    Check if shell completions are correctly configured for your environment.
    copy

    $ rake completion:check

    • Enhance technology listing (--list-techs) output formatting and hierarchy

    1 detail in Everything

64. v0.18.0 Oct 31, 2024 · release notes

    Passive scanning mode and status code filtering for noir v0.18.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.18.0 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v0.18.0

    └──▷ TRY IT
    Perform passive scanning using a recorded request file to analyze historical traffic safely
    copy

    $ noir -P --passive-scan-path ./traffic.pcap -o results.json

    Filter out successful responses to focus on errors during an active scan
    copy

    $ noir --exclude-codes 200,201,204 -t https://example.com/api/

    • -P, --passive-scan and --passive-scan-path flags enable passive scanning without active traffic generation
    • --status-codes and --exclude-codes CLI options allow filtering HTTP responses by status code
    • ActixWeb detector added for Rust web application analysis

    3 details in Everything

65. v0.17.0 Aug 1, 2024 · release notes

    Adds -only-tag flag to extract specific risk tags from scan results

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.17.0 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v0.17.0

    └──▷ USE IT
    Extract only the identified risk tags from a target analysis to quickly spot high-level risks.
    shell copy

    noir -b <TARGET> -T -f only-tag

    • -only-tag flag filters noir output to show only detected tag names (e.g., sqli, oauth)
    • Enhanced output formats for improved readability
    • Java Spring: Added parsing logic for application.properties files

    3 details in Everything

66. v0.16.0 Jun 8, 2024 · release notes

    Adds --diff-path, NOIR_HOME config directory, completions, and Spring Kotlin analysis

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.16.0 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v0.16.0

    └──▷ USE IT
    Run a diff scan against a pull request branch to see new vulnerabilities compared to main.
    shell copy

    noir scan -b main --diff-path feature-branch

    Customize the location of the config home directory for container or CI environments.
    shell copy

    export NOIR_HOME=/etc/noir && noir scan target/

    Set up shell tab completion for easier CLI usage.
    shell copy

    noir --generate-completion zsh > /usr/local/share/zsh/site-functions/_noir

    • Adds the NOIR_HOME environment variable to override the default config home directory path (default: ~/.config/noir).
    • Adds the --diff-path flag to compare scan results between a base path (-b) and a specified target path.
    • Adds the --generate-completion subcommand/flag to output shell completion scripts for zsh and bash.
    • Adds the --build-info flag to display tool build details (Crystal, LLVM versions).
    • Improves the Kotlin Spring analyzer to support parameter analysis matching the Java Spring analyzer.

    5 details in Everything

67. v0.15.0 Apr 29, 2024 · release notes

    Adds support for Restify (JS), Beego (Go), Rocket (Rust) frameworks, new CORSCORSA browser mechanism that lets a server declare which foreign origins may read its HTTP responses, enforced by the browser to block unauthorized cross-site requests from JavaScript./SOAP/WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. tags, and arm64 Docker image

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.0 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v0.15.0

    • Supports Restify (JavaScript), Beego (Go), and Rocket (Rust) framework patterns in scans
    • Adds CORS, SOAP, and WebSocket as new tag values for categorizing findings or assets
    • Provides an official arm64 architecture Docker image for the noir scanner

    3 details in Everything

68. v0.14.0 Mar 29, 2024 · release notes

    Adds taggers (hunt, oauth) and HARHARAn HTTP Archive file, a JSON-format log of all network requests and responses captured by a browser's developer tools, used by cyber tools to replay, inspect, or analyze web traffic without re-running a live session. format support with new CLI flags

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.14.0 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v0.14.0

    • Adds -T (--use-all-taggers), --use-taggers, and --list-taggers flags to enable automatic tagging of identified information during source code analysis
    • Introduces hunt and oauth as available taggers for Endpoint and Parameter metadata
    • Enables processing HAR format files via the -u argument to identify URLs as Endpoints

    3 details in Everything

69. v0.13.0 Mar 7, 2024 · release notes

    Adds MiniLexer source code analyzer and snapcraft installation support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.13.0 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v0.13.0

    • Adds MiniLexer lightweight lexer/parser for accurate analysis of Java and Golang syntax.

    1 detail in Everything

70. v0.12.2 Feb 3, 2024 · release notes

    Adds --config flag for file-based configuration

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.2 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v0.12.2

    └──▷ USE IT
    Use a configuration file instead of passing all options via CLI arguments.
    shell copy

    noir --config /path/to/config.yaml

71. v0.12.1 Jan 12, 2024 · release notes

    noir v0.12.1 adds -f output format options for targeted extraction

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.1 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v0.12.1

    └──▷ TRY IT
    Extract a list of function parameters from source code for fuzzing without post-processing.
    copy

    $ noir -b my_app -f only-param

    Export findings in a line-delimited JSON format suitable for streaming or log ingestion.
    copy

    $ noir -b my_app -f jsonl

    • Adds only-url, only-param, only-header, and only-cookie output formats to the -f flag
    • Adds jsonl output format to the -f flag

    2 details in Everything

72. v0.12.0 Dec 31, 2023 · release notes

    v0.12.0 introduces FileAnalyzer with Hooks for file-based scans and go-fiber framework support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.0 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v0.12.0

    └──▷ TRY IT
    Scan files and see exactly which source file contains a detected endpoint by using the --include-path flag to get detailed file paths in JSON output.
    copy

    $ noir scan --format json --include-path <target_file_or_dir>

    • --include-path flag now reveals the original source code file of detected endpoints in CLI output, JSON, and YAML results
    • New FileAnalyzer with Hooks for language-agnostic file-based scans, supporting URL detection, Base64 decoding, and more
    • Added go-fiber detector & analyzer for Go Fiber web framework support

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !--scope flag has been removed
73. v0.11.0 Dec 6, 2023 · release notes

    noir v0.11.0 adds detectors for Ruby Hanami, Elixir Phoenix, and Crystal Lucky; supports cookie parameter type and --concurrency flag

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.11.0 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v0.11.0

    └──▷ TRY IT
    Scan a web application while specifying the maximum number of concurrent analysis tasks
    copy

    $ noir scan --concurrency=4 /path/to/app

    • Adds detection of Ruby Hanami applications via the Ruby Hanami detector
    • Adds detection of Elixir Phoenix applications via the Elixir Phoenix detector
    • Adds detection of Crystal Lucky applications via the Crystal Lucky detector
    • Enables analysis of HTTP cookie parameter types with the new cookie parameter type
    • Adds the --concurrency CLI flag to control parallel processing

    5 details in Everything

74. v0.10.0 Oct 26, 2023 · release notes

    Adds rust-axum detector and --use-matchers / --use-filters flags for Deliver

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.10.0 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v0.10.0

    └──▷ USE IT
    Scan a site and only deliver URLs containing /update or /socket.
    shell copy

    noir -b . -u https://www.hahwul.com --use-matchers "/update" --use-matchers "/socket"

    Exclude URLs containing /admin from being delivered.
    shell copy

    noir -b . -u https://www.hahwul.com --use-filters "/admin"

    • rust-axum detector/analyzer added to noir.
    • Adds --use-matchers flag for Deliver to specify conditions a URL must meet.
    • Adds --use-filters flag for Deliver to specify conditions a URL must not meet.

    3 details in Everything

75. v0.9.0 Sep 28, 2023 · release notes

    Adds FastAPI detector, --send-es ElasticSearch delivery flag, and -f yaml output format

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.9.0 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v0.9.0

    └──▷ USE IT
    Analyze a FastAPI application's endpoints and parameters for security issues.
    shell copy

    noir -b ./fastapi_app

    Send scan results to a remote ElasticSearch cluster for indexing.
    shell copy

    noir -b <BASE-PATH> --send-es http://<ES-ENDPOINT>/<INDEX>/<TYPE>

    Output scan results in YAML format instead of the default.
    shell copy

    noir -b <BASE-PATH> -f yaml

    • Adds FastAPI Detector & Analyzer that supports URL, Method, Param, Header, and WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. analysis via the noir -b <BASE-PATH> command.
    • Adds --send-es flag to deliver results to an ElasticSearch endpoint.
    • Adds YAML output format selectable with -f yaml.

    3 details in Everything

76. v0.8.0 Sep 26, 2023 · release notes

    noir v0.8.0 adds --with-headers flag and oas2/oas3 output formats

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.8.0 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v0.8.0

    └──▷ TRY IT
    Inject custom authorization headers when sending proxy requests.
    copy

    $ noir -b ./source --send-proxy http://localhost:8090 --with-headers "X-API-Key: ABCD"

    Export the analyzed API specification in Swagger 2.0 format.
    copy

    $ noir -b . -f oas2

    • Adds --with-headers flag for Delivers to inject arbitrary HTTP headers.
    • Adds oas2 output format via -f oas2 flag.
    • Adds oas3 output format via -f oas3 flag.

    3 details in Everything

77. v0.7.0 Sep 13, 2023 · release notes

    Adds Kotlin Spring, Java Armeria, and C# ASP.NET MVC support with improved analyzers

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.7.0 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v0.7.0

    • Support to C# ASP.NET MVC (First step, Only URL Endpoints)
    • Improve Analyzers for Java Spring
    • Improve Analyzers for Python Django (Add Method / Param / Header)

    3 details in Everything

78. v0.6.0 Sep 5, 2023 · release notes

    Adds support for scanning Go Gin and RAML APIs with new analyzers

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.6.0 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v0.6.0

    • Adds Go Gin support to the Analyzer (Endpoint, Method, Param, Header)
    • Adds RAML support to the Detector and Analyzer (Endpoint, Method, Param, Header)
    • Adds JSP Analyzer (+With param)

    3 details in Everything

79. v0.5.3 Aug 30, 2023 · release notes

    Noir v0.5.3 adds Header parameter identification to PHP analyzers

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.5.3 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v0.5.3

80. v0.5.2 Aug 27, 2023 · release notes

    noir v0.5.2 adds Analyzer support for Spring RouterFunction, Echo params, and Rails headers.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.5.2 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v0.5.2

    • Spring analyzer now includes RouterFunction analysis
    • Go Echo analyzer adds parameter (param) analysis
    • Rails analyzer adds header analysis

    3 details in Everything

81. v0.5.0 Aug 21, 2023 · release notes

    Adds OAS 3 detection support and explicit YAML/JSON configuration keys for OAS2/OAS3 definitions

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.5.0 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v0.5.0

    • oas3 detection configuration section added to .noir.yaml with format (JSON, YAML) and similar aliases (oas 3.0, oas_3_0) to enable OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. Specification 3 analysis.
    • oas2 configuration section in .noir.yaml now explicitly lists aliases oas 2.0, oas_2_0, swagger 2.0, swagger_2_0, and swagger for Swagger/OpenAPI 2 detection.

    2 details in Everything

82. v0.4.0 Aug 15, 2023 · release notes

    Noir v0.4.0 adds Swagger analysis for JSON/YAML endpoints and a CodeLocator singleton API.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.4.0 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v0.4.0

    └──▷ USE IT
    Use the new CodeLocator API within a custom detector or analyzer script to share data between modules.
    ruby copy

    locator = CodeLocator.instance
    locator.set('swagger-json', 'docs.json')
    puts locator.get('swagger-json') # outputs docs.json

    • Adds Swagger Analysis capability to detect and extract API endpoints from JSON and YAML swagger documents in the target source code.
    • Exposes CodeLocator.instance singleton for data communication between detectors and analyzers, with set(key, value) and get(key) methods.

    2 details in Everything

83. v0.3.0 Aug 13, 2023 · release notes

    Adds --exclude-techs flag to ignore specific technologies during scans

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.0 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v0.3.0

    └──▷ USE IT
    Scan a target but skip fingerprinting for Ruby/Rails applications.
    shell copy

    noir scan --exclude-techs ruby-rails <target>

    • Adds --exclude-techs CLI argument to filter out specified tech stacks from detection results
    • Renames the existing --techs-list flag to --list-techs

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --techs-list CLI argument is renamed to --list-techs; scripts using the old name will fail.
84. v0.2.3 Aug 10, 2023 · release notes

    v0.2.3 adds Spring and Echo framework analyzer improvements

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.2.3 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v0.2.3

    • spring_analyzer now includes improved detection capabilities for Spring-based applications.
    • echo_analyzer gains refined endpoint discovery logic for Go Echo frameworks.

    2 details in Everything

85. v0.2.0 Aug 5, 2023 · release notes

    noir v0.2.0 adds ws endpoint support and Crystal Kemal detector

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.2.0 https://github.com/owasp-noir/noir.git
    # already have the repo? check out this version:
    $ git checkout v0.2.0

    • Adds ws endpoint type to enable WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. testing capabilities
    • Adds new detector and analyzer for crystal-kemal frameworks

    2 details in Everything