https://cybertoolchain.io/tools/noir New releases and features in noir, tracked by The Cyber Toolchain. en Mon, 02 Nov 2026 00:03:41 GMT https://github.com/owasp-noir/noir/releases/tag/v1.5.0 https://github.com/owasp-noir/noir/releases/tag/v1.5.0 Mon, 02 Nov 2026 00:03:41 GMT noir adds query verbs, native Windows and npm installs, an Anthropic/Gemini AI provider, and 69 new framework detections⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Match a request to its route with `noir trace`, list routes that reach a file with `noir reach FILE[:LINE]`, and filter by guard, sink, param, path or handler with `noir query` — all reading a saved report via `--from` or scanning live.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Control AI behaviour with new flags `--ai-stream`, `--ai-key-file`, and `--ai-temperature`, and attach per-endpoint review context using the new `ai_context` JSON Schema. • Use a native Anthropic provider or a Gemini preset alongside existing AI providers, with explicit provider errors when misconfigured. • Install noir on Windows via a static `.exe` release or via npm as `@owasp-noir/noir`. • noir now detects 69 additional technologies, including React Router v7, SolidStart, Qwik City, Bun and Deno `serve`, ts-rest, oRPC, Effect HttpApi, tsoa, routing-controllers, Ts.ED, inversify, Cloudflare Pages, Vercel, Netlify and Firebase functions, Laravel Livewire, Folio, API Platform, Nextcloud, Razor Pages and Blazor, WCF, Spring Data REST, Vaadin, Apache Camel, Revel, Leptos, Salesforce Apex, C servers (Mongoose, CivetWeb, libmicrohttpd), Apache Thrift, API gateways (Ocelot, YARP, Spring Cloud Gateway, KrakenD, Tyk, Apigee, HAProxy), and Hurl, Hoppscotch and Thunder Client collections. • TypeScript, TSX and Ruby now use their own tree-sitter grammars, improving AST-based parsing for NestJS-family decorators, Fastify, Feathers, tRPC, LoopBack, and Rails callbacks. • Large repositories now scan faster — GitLab drops from 13s to 4.3s, vikunja from 15.6s to 2.0s, qdrant from 4.2s to 1.8s, and n8n peak memory from 669 MB to 410 MB. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v1.4.0 https://github.com/owasp-noir/noir/releases/tag/v1.4.0 Sun, 27 Sep 2026 13:51:28 GMT Noir v1.4.0 adds `--diff-ref` attack-surface diff mode with auth-removal detection, SARIF/markdown reports, and ~1.75x faster full scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--diff-ref` to diff the attack surface against a git revision, flagging changed endpoints and lost authentication as `auth_removed`; `--fail-on` exits with code 3 on matching findings, and the GitHub Action exposes `diff_ref` and `fail_on` inputs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Diff mode renders markdown and SARIF diff reports for CI consumption. • Merged endpoints now carry every contributing technology in `details.technologies`. • File upload params now emit multipart bodies in curl, httpie, PowerShell, OAS2, and OAS3 output; XML params emit `application/xml` bodies in OAS and Postman output. • Adds support for Express routes registered through a forwarding helper and the field form of the gRPC `google.api.http` annotation. • Directory listing, file reads, passive-scan rules, and Go route parsing now run on worker threads in walk order, making default scans ~1.4x faster and full scans ~1.75x faster. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v1.3.1 https://github.com/owasp-noir/noir/releases/tag/v1.3.1 Wed, 02 Sep 2026 15:49:41 GMT Noir v1.3.1 adds source line numbers for Rails/OpenAPI/Spring routes, cross-file $ref resolution, and protocol badges in plain output. • The plain text report now shows the protocol (`kafka`, `mqtt`, `amqp`, …) and an `[internal]` badge, matching what structured formats (`-f json`, `-f yaml`, etc.) already displayed. • Adds source line numbers for route declarations in Rails `config/routes.rb`, OpenAPI/Swagger operations, Symfony `#[Route]` attributes and `routes.yaml`, Vert.x, and Spring reactive `RouterFunction` routes — so findings point to the exact line. • OpenAPI documents over 10 MB now get their own 64 MB parsing budget instead of being silently dropped. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v1.3.0 https://github.com/owasp-noir/noir/releases/tag/v1.3.0 Tue, 18 Aug 2026 15:54:04 GMT Noir v1.3.0 adds HTTP QUERY method (RFC 10008) support, 11 new framework analyzers, and scan-integrity reporting with `--strict`. • Adds `--strict` flag to exit non-zero when any analyzer fails or file is skipped, surfacing scan-integrity failures that were previously silently dropped. • Adds end-to-end support for the HTTP QUERY method (RFC 10008) across ~24 frameworks including Express, Fastify, Hono, NestJS, Flask, aiohttp, Rails, Laravel, Phoenix/Plug, Echo, Fiber, Go `net/http`, axum, Ktor, http4k, Micronaut, Vert.x, JAX-RS/Quarkus/Dropwizard, ASP.NET Core, and Kemal — including OAS3 serialization and HTML report rendering. • Adds 11 new framework analyzers: Oak (Deno), Feathers.js, Sails.js, LoopBack 4, CherryPy, Masonite, Padrino, Phalcon, Helidon, ServiceStack, and Kratos. • Recovers iOS deep-link routes that were previously missed during config-only scanning. • Failed analyzers and skipped files are now reported in scan output instead of being silently dropped. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v1.2.0 https://github.com/owasp-noir/noir/releases/tag/v1.2.0 Sun, 19 Jul 2026 14:02:03 GMT Noir v1.2.0 adds CLI app surface detection, 9 stdlib HTTP servers, schema-driven APIs, enterprise legacy stacks, and major perf gains. • Detects CLI application attack surfaces (argv, flags, env vars) across 17 languages and 40+ libraries including Cobra, Click, clap, Commander, Thor, and picocli. • Adds built-in HTTP server analyzers for Go (`net/http`), Python (`http.server`), Node (`node:http`), Java (`com.sun.net.httpserver`), C# (`HttpListener`), Ruby (WEBrick), Crystal, Dart, and Zig. • Adds schema-generated API analyzers for Strapi, Directus, Payload CMS, Supabase/PostgREST, Hasura, and Appwrite — extracting routes and params from schema files rather than source routes. • Adds enterprise legacy stack support: CFML/ColdFusion, Classic ASP, ASP.NET WebForms, and CFML frameworks Taffy, ColdBox, Wheels, and FW/1. • Adds BEAM language support: Erlang (Cowboy, Elli) and Gleam (Wisp). • Adds PHP CMS/platform analyzers for WordPress (REST API, admin-ajax, admin-post), Drupal (`*.routing.yml`), and Magento (Web API + MVC controller routes). • Adds Django Ninja (Python) and Plumber (R) framework analyzers. • Adds Terraform/OpenTofu analyzer to extract AWS API Gateway v1/v2 routes from `.tf` HCL and `.tf.json` files, resolved module-wide. • Adds realtime/event endpoint detection for SignalR, Socket.IO, Phoenix Channels, and Action Cable. • Adds OpenRPC and `.http`/`.rest` request file (VS Code REST Client, JetBrains HTTP Client) specification analyzers. • Adds machine-readable output for `noir list` and documents `noir cache purge`. • Adds Claude Sonnet 5, Grok 4.5, and GPT-5.6 to the AI provider token map. • Redesigned HTML report (`-f html`) with dark-tech theme, semantic method/severity colors, path grouping, table view, and copy URL/curl actions. • Codebase-wide performance sweep eliminates O(n²) scans, adds precompiled regex unions, and memoizes tree-sitter results — delivering order-of-magnitude speedups (e.g., F#/Giraffe 31.7s → 1.1s, Servant 101s → 4ms). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v1.2.0 https://github.com/owasp-noir/noir/releases/tag/v1.2.0 Sun, 19 Jul 2026 14:02:03 GMT Noir v1.2.0 adds CLI app surface detection, 9 stdlib HTTP servers, schema-driven APIs, enterprise legacy stacks, and major perf gains. • Detects CLI application attack surfaces (argv, flags, env vars) across 17 languages and 40+ libraries including Cobra, Click, clap, Commander, Thor, and picocli. • Adds built-in HTTP server analyzers for Go (`net/http`), Python (`http.server`), Node (`node:http`), Java (`com.sun.net.httpserver`), C# (`HttpListener`), Ruby (WEBrick), Crystal, Dart, and Zig. • Adds schema-generated API analyzers for Strapi, Directus, Payload CMS, Supabase/PostgREST, Hasura, and Appwrite — extracting routes and params from schema files rather than source routes. • Adds enterprise legacy stack support: CFML/ColdFusion, Classic ASP, ASP.NET WebForms, and CFML frameworks Taffy, ColdBox, Wheels, and FW/1. • Adds BEAM language support: Erlang (Cowboy, Elli) and Gleam (Wisp). • Adds PHP CMS/platform analyzers for WordPress (REST API, admin-ajax, admin-post), Drupal (`*.routing.yml`), and Magento (Web API + MVC controller routes). • Adds Django Ninja (Python) and Plumber (R) framework analyzers. • Adds Terraform/OpenTofu analyzer to extract AWS API Gateway v1/v2 routes from `.tf` HCL and `.tf.json` files, resolved module-wide. • Adds realtime/event endpoint detection for SignalR, Socket.IO, Phoenix Channels, and Action Cable. • Adds OpenRPC and `.http`/`.rest` request file (VS Code REST Client, JetBrains HTTP Client) specification analyzers. • Adds machine-readable output for `noir list` and documents `noir cache purge`. • Adds Claude Sonnet 5, Grok 4.5, and GPT-5.6 to the AI provider token map. • Redesigned HTML report (`-f html`) with dark-tech theme, semantic method/severity colors, path grouping, table view, and copy URL/curl actions. • Codebase-wide performance sweep eliminates O(n²) scans, adds precompiled regex unions, and memoizes tree-sitter results — delivering order-of-magnitude speedups (e.g., F#/Giraffe 31.7s → 1.1s, Servant 101s → 4ms). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v0.29.0 https://github.com/owasp-noir/noir/releases/tag/v0.29.0 Sat, 28 Mar 2026 14:06:26 GMT Noir v0.29.0 adds support for Salvo, Hono, Nitro.js, httprouter, GoFrame, gRPC spec analysis, and the NOIR_PARSER_MAX_DEPTH env var. • `NOIR_PARSER_MAX_DEPTH` environment variable to cap import-following depth • gRPC specification analyzer and detector • Salvo (Rust) framework support • Hono (Node.js) framework support • Nitro.js framework support • httprouter (Go) framework support • GoFrame (Go) framework support • Kemal namespace and mount routing support Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v0.28.0 https://github.com/owasp-noir/noir/releases/tag/v0.28.0 Sun, 22 Feb 2026 04:19:59 GMT noir v0.28.0 introduces AI Agent Mode for autonomous discovery and ACP integration for local agents • `--ai-agent` flag to enable iterative tool-calling AI workflow with subtools like `list_directory`, `read_file`, `grep`, and `semantic_search`. • `--ai-provider=acp:<name>` argument to analyze targets using locally configured ACP agents without external API keys. • Enhanced analyzer support for Cross-file Express.js routers. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v0.27.0 https://github.com/owasp-noir/noir/releases/tag/v0.27.0 Thu, 15 Jan 2026 11:55:44 GMT NOIR v0.27.0 adds NuxtJS/TanStack Router/Swift detectors, TOML output, and new tech-scope flags • `--include-techs` and `--only-techs` flags added to the CLI to control technology detection scope. • `technology` field added to detailed endpoint information output. • Added TOML output format via `-f toml` flag. • New NuxtJS detector and analyzer capability. • New TanStack Router detector and analyzer for TypeScript projects. • Swift Hummingbird detector and analyzer now available. • Swift Kitura detector and analyzer now available. • Java & Scala Play analyzer now supports body, header, and cookie parameters. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v0.26.0 https://github.com/owasp-noir/noir/releases/tag/v0.26.0 Sat, 20 Dec 2025 14:10:29 GMT noir v0.26.0 adds Postman, HTML, PowerShell output formats, new taggers, and expanded framework support • `-f postman` flag enables Postman Collection v2.1.0 output format • `-f html` flag enables HTML output format • `-f powershell` flag enables PowerShell Invoke-WebRequest output format • Added new GraphQL, JWT, and FileUpload taggers for detecting specific request types • Expanded detector/analyzer support for Scala (Scalatra, Play, Akka), Swift (Vapor), TypeScript (NestJS), and C# ASP.NET Core MVC frameworks Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v0.25.1 https://github.com/owasp-noir/noir/releases/tag/v0.25.1 Sun, 16 Nov 2025 14:32:55 GMT Adds OWASP logo to docs footer and token limits for new AI models; expands ASP.NET MVC analyzer for attribute routing • Expand ASP.NET MVC analyzer to support attribute routing and parameter binding Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v0.25.0 https://github.com/owasp-noir/noir/releases/tag/v0.25.0 Sat, 08 Nov 2025 16:13:08 GMT Adds SARIF output, Postman Collection JSON, expanded parameter types for more frameworks, and multiple -b flags. • `--sarif` flag added to export findings in SARIF format • `--postman` flag added to export API specs as a Postman Collection JSON file • `-b` / `--base` flag now accepts multiple values for tracking changes across several base commits Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v0.24.0 https://github.com/owasp-noir/noir/releases/tag/v0.24.0 Fri, 19 Sep 2025 14:37:59 GMT Adds `--passive-scan-severity`, GitHub Action support, SBOM generation, and new framework detectors in Noir v0.24.0 • Adds `--passive-scan-severity` CLI flag to set minimum severity level for passive scans • Adds `--passive-scan-auto-update` and `--passive-scan-no-update-check` flags to control automatic passive scan rule updates • Adds official OWASP Noir GitHub Action integration • Adds SBOM (Software Bill of Materials) generation support • Adds support for 17 new detectors/analyzers including Marten, Grip, Amber, Plug, Go-Zero, FastHTTP, Mix, Vert.x, Next.js, Ktor, Symfony, Laravel, Tornado, Sanic, Gotham, Tide, and Warp • Adds `--cache-disable` and `--cache-clear` flags to control LLM cache behavior Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v0.23.1 https://github.com/owasp-noir/noir/releases/tag/v0.23.1 Mon, 18 Aug 2025 14:40:41 GMT Adds `Method` and `Method:URL` options to Matchers and Filters • `Method:URL` added to Matchers and Filters Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v0.23.0 https://github.com/owasp-noir/noir/releases/tag/v0.23.0 Sat, 16 Aug 2025 07:10:14 GMT Adds Loco, rwf, and FeignClient detectors; mermaid output for endpoints (-f mermaid); Express dynamic path support • Added `-f mermaid` to output endpoint discovery as a Mermaid mindmap • Added Loco framework detector and analyzer • Added rwf detector and analyzer • Added FeignClient interface analysis • Recognized router.all in Express Endpoint Detection for Dynamic Paths Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v0.22.0 https://github.com/owasp-noir/noir/releases/tag/v0.22.0 Sat, 21 Jun 2025 13:42:08 GMT Adds .graphql file analyzer and Koa.js detector/analyzer to noir. • `feat: Add detector and analyzer for Koa.js` adds the new detector and analyzer capabilities for Koa.js applications • `Add .graphql file analyzer` enables scanning of GraphQL schema files Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v0.21.1 https://github.com/owasp-noir/noir/releases/tag/v0.21.1 Thu, 22 May 2025 14:04:04 GMT Adds `--ai-max-token` flag and AI token limit configuration to control LLM token usage • Adds `--ai-max-token` CLI flag for controlling the maximum number of tokens the LLM can use during analysis • Adds a new configuration key for setting the AI token limit in the noir config file Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v0.21.0 https://github.com/owasp-noir/noir/releases/tag/v0.21.0 Mon, 07 Apr 2025 13:47:27 GMT Adds Fastify detector and router-based route handling for Express and Restify in noir v0.21.0 • Added Fastify detector and analyzer with TypeScript support Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v0.20.0 https://github.com/owasp-noir/noir/releases/tag/v0.20.0 Sat, 01 Mar 2025 04:50:47 GMT Noir v0.20.0 adds AI provider flags, local LLM support (Ollama/vLLM), and `.http` file analysis. • Adds `--ai-provider`, `--ai-model`, and `--ai-key` CLI flags to control AI integration sources and credentials • Enables local LLM support for Ollama, LM Studio, and vLLM as AI providers • Adds intellij `.http` file analysis capability (FileAnalyzer) • Adds golang chi framework detector and analyzer Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v0.18.3 https://github.com/owasp-noir/noir/releases/tag/v0.18.3 Sun, 17 Nov 2024 13:53:50 GMT Adds `completion:check` Rake task and refines `--list-techs` output • Enhance technology listing (--list-techs) output formatting and hierarchy Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v0.18.0 https://github.com/owasp-noir/noir/releases/tag/v0.18.0 Thu, 31 Oct 2024 13:38:11 GMT Passive scanning mode and status code filtering for noir v0.18.0 • `-P`, `--passive-scan` and `--passive-scan-path` flags enable passive scanning without active traffic generation • `--status-codes` and `--exclude-codes` CLI options allow filtering HTTP responses by status code • ActixWeb detector added for Rust web application analysis Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v0.17.0 https://github.com/owasp-noir/noir/releases/tag/v0.17.0 Thu, 01 Aug 2024 14:23:22 GMT Adds `-only-tag` flag to extract specific risk tags from scan results • `-only-tag` flag filters noir output to show only detected tag names (e.g., sqli, oauth) • Enhanced output formats for improved readability • Java Spring: Added parsing logic for `application.properties` files Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v0.16.0 https://github.com/owasp-noir/noir/releases/tag/v0.16.0 Sat, 08 Jun 2024 08:14:10 GMT Adds `--diff-path`, `NOIR_HOME` config directory, completions, and Spring Kotlin analysis • Adds the `NOIR_HOME` environment variable to override the default config home directory path (default: `~/.config/noir`). • Adds the `--diff-path` flag to compare scan results between a base path (-b) and a specified target path. • Adds the `--generate-completion` subcommand/flag to output shell completion scripts for zsh and bash. • Adds the `--build-info` flag to display tool build details (Crystal, LLVM versions). • Improves the Kotlin Spring analyzer to support parameter analysis matching the Java Spring analyzer. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v0.15.0 https://github.com/owasp-noir/noir/releases/tag/v0.15.0 Mon, 29 Apr 2024 15:23:06 GMT Adds support for Restify (JS), Beego (Go), Rocket (Rust) frameworks, new CORS/SOAP/WebSocket tags, and arm64 Docker image • Supports Restify (JavaScript), Beego (Go), and Rocket (Rust) framework patterns in scans • Adds `CORS`, `SOAP`, and `WebSocket` as new tag values for categorizing findings or assets • Provides an official arm64 architecture Docker image for the noir scanner Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v0.14.0 https://github.com/owasp-noir/noir/releases/tag/v0.14.0 Fri, 29 Mar 2024 15:25:47 GMT Adds taggers (hunt, oauth) and HAR format support with new CLI flags • Adds -T (--use-all-taggers), `--use-taggers`, and `--list-taggers` flags to enable automatic tagging of identified information during source code analysis • Introduces `hunt` and `oauth` as available taggers for Endpoint and Parameter metadata • Enables processing HAR format files via the `-u` argument to identify URLs as Endpoints Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v0.13.0 https://github.com/owasp-noir/noir/releases/tag/v0.13.0 Thu, 07 Mar 2024 14:59:40 GMT Adds MiniLexer source code analyzer and snapcraft installation support. • Adds `MiniLexer` lightweight lexer/parser for accurate analysis of Java and Golang syntax. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v0.12.2 https://github.com/owasp-noir/noir/releases/tag/v0.12.2 Sat, 03 Feb 2024 12:16:01 GMT Adds `--config` flag for file-based configuration • Adds `--config` flag for file-based configuration Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v0.12.1 https://github.com/owasp-noir/noir/releases/tag/v0.12.1 Fri, 12 Jan 2024 14:31:50 GMT noir v0.12.1 adds `-f` output format options for targeted extraction • Adds `only-url`, `only-param`, `only-header`, and `only-cookie` output formats to the `-f` flag • Adds `jsonl` output format to the `-f` flag Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v0.12.0 https://github.com/owasp-noir/noir/releases/tag/v0.12.0 Sun, 31 Dec 2023 07:40:56 GMT v0.12.0 introduces FileAnalyzer with Hooks for file-based scans and go-fiber framework support • `--include-path` flag now reveals the original source code file of detected endpoints in CLI output, JSON, and YAML results • New `FileAnalyzer` with Hooks for language-agnostic file-based scans, supporting URL detection, Base64 decoding, and more • Added go-fiber detector & analyzer for Go Fiber web framework support Breaking changes: • `--scope` flag has been removed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v0.9.0 https://github.com/owasp-noir/noir/releases/tag/v0.9.0 Thu, 28 Sep 2023 15:48:28 GMT Adds FastAPI detector, `--send-es` ElasticSearch delivery flag, and `-f yaml` output format • Adds FastAPI Detector & Analyzer that supports URL, Method, Param, Header, and WebSocket analysis via the `noir -b <BASE-PATH>` command. • Adds `--send-es` flag to deliver results to an ElasticSearch endpoint. • Adds YAML output format selectable with `-f yaml`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v0.8.0 https://github.com/owasp-noir/noir/releases/tag/v0.8.0 Tue, 26 Sep 2023 12:02:59 GMT noir v0.8.0 adds --with-headers flag and oas2/oas3 output formats • Adds `--with-headers` flag for Delivers to inject arbitrary HTTP headers. • Adds `oas2` output format via `-f oas2` flag. • Adds `oas3` output format via `-f oas3` flag. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v0.7.0 https://github.com/owasp-noir/noir/releases/tag/v0.7.0 Wed, 13 Sep 2023 14:43:40 GMT Adds Kotlin Spring, Java Armeria, and C# ASP.NET MVC support with improved analyzers • Support to C# ASP.NET MVC (First step, Only URL Endpoints) • Improve Analyzers for Java Spring • Improve Analyzers for Python Django (Add Method / Param / Header) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v0.6.0 https://github.com/owasp-noir/noir/releases/tag/v0.6.0 Tue, 05 Sep 2023 15:51:57 GMT Adds support for scanning Go Gin and RAML APIs with new analyzers • Adds Go Gin support to the Analyzer (Endpoint, Method, Param, Header) • Adds RAML support to the Detector and Analyzer (Endpoint, Method, Param, Header) • Adds JSP Analyzer (+With param) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v0.5.3 https://github.com/owasp-noir/noir/releases/tag/v0.5.3 Wed, 30 Aug 2023 16:17:40 GMT Noir v0.5.3 adds Header parameter identification to PHP analyzers • Adds identification of Header parameters for PHP analysis. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v0.5.2 https://github.com/owasp-noir/noir/releases/tag/v0.5.2 Sun, 27 Aug 2023 15:15:43 GMT noir v0.5.2 adds Analyzer support for Spring RouterFunction, Echo params, and Rails headers. • `Spring` analyzer now includes `RouterFunction` analysis • `Go Echo` analyzer adds parameter (`param`) analysis • `Rails` analyzer adds header analysis Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v0.5.0 https://github.com/owasp-noir/noir/releases/tag/v0.5.0 Mon, 21 Aug 2023 16:02:19 GMT Adds OAS 3 detection support and explicit YAML/JSON configuration keys for OAS2/OAS3 definitions • `oas3` detection configuration section added to `.noir.yaml` with `format` (JSON, YAML) and `similar` aliases (oas 3.0, oas_3_0) to enable OpenAPI Specification 3 analysis. • `oas2` configuration section in `.noir.yaml` now explicitly lists aliases `oas 2.0`, `oas_2_0`, `swagger 2.0`, `swagger_2_0`, and `swagger` for Swagger/OpenAPI 2 detection. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v0.4.0 https://github.com/owasp-noir/noir/releases/tag/v0.4.0 Tue, 15 Aug 2023 14:51:34 GMT Noir v0.4.0 adds Swagger analysis for JSON/YAML endpoints and a CodeLocator singleton API. • Adds Swagger Analysis capability to detect and extract API endpoints from JSON and YAML swagger documents in the target source code. • Exposes `CodeLocator.instance` singleton for data communication between detectors and analyzers, with set(key, value) and get(key) methods. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v0.3.0 https://github.com/owasp-noir/noir/releases/tag/v0.3.0 Sun, 13 Aug 2023 11:00:39 GMT Adds `--exclude-techs` flag to ignore specific technologies during scans • Adds `--exclude-techs` CLI argument to filter out specified tech stacks from detection results • Renames the existing `--techs-list` flag to `--list-techs` Breaking changes: • The `--techs-list` CLI argument is renamed to `--list-techs`; scripts using the old name will fail. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v0.2.3 https://github.com/owasp-noir/noir/releases/tag/v0.2.3 Thu, 10 Aug 2023 16:49:28 GMT v0.2.3 adds Spring and Echo framework analyzer improvements • `spring_analyzer` now includes improved detection capabilities for Spring-based applications. • `echo_analyzer` gains refined endpoint discovery logic for Go Echo frameworks. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir https://github.com/owasp-noir/noir/releases/tag/v0.2.0 https://github.com/owasp-noir/noir/releases/tag/v0.2.0 Sat, 05 Aug 2023 10:01:50 GMT noir v0.2.0 adds `ws` endpoint support and Crystal Kemal detector • Adds `ws` endpoint type to enable WebSocket testing capabilities • Adds new detector and analyzer for `crystal-kemal` frameworks Full history on Cyber Toolchain: https://cybertoolchain.io/tools/noir