sara

No entries match these filters. Clear filters

1. v1.4.0 Oct 10, 2026 · issue 102

   Sara v1.4.0 rewrites its audit engine over the RouterOS APIRouterOS APIA structured TCP interface exposed by Mikrotik's RouterOS that lets programs query and configure the router programmatically, avoiding SSH screen-scraping and enabling reliable automation of network device management. with 22 structured checks and adds a CVE lookup mode.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.4.0 https://github.com/ifritnoises/sara.git
   # already have the repo? check out this version:
   $ git checkout v1.4.0

   └──▷ TRY IT
   Look up CVEs for a specific RouterOS version without connecting to a device — useful for offline or pre-upgrade risk assessment.
   copy

   $ sara cve --version 7.14.3

   Audit a router that exposes the API on a non-standard port, e.g. in a hardened deployment where 8729 is remapped.
   copy

   $ sara audit 192.168.88.1 sara --port 8730

   • Adds sara audit <IP> <USERNAME> command that connects over the RouterOS API (api-ssl, port 8729 by default) to check MikroTik router configuration for 22 named checks (MGMT-001 through WIFI-002), each returning severity, live evidence from the router, and a RouterOS fix command.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds --port flag to sara audit to target a non-standard RouterOS API port.
   • Adds --plaintext flag to sara audit to switch from api-ssl (port 8729) to the unencrypted api service (port 8728).
   • Adds sara cve <IP> <USERNAME> command to look up CVEs for the RouterOS version running on a connected router via the NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. API.
   • Adds sara cve --version <VERSION> to look up CVEs for any RouterOS version without connecting to a router.

   +1 more show less

   • Migrates transport from SSH (Netmiko) to the RouterOS API (librouteros), dropping dependencies on python3-netmiko and python3-packaging.
   • Adds sara audit <IP> <USERNAME> command that connects over the RouterOS API (api-ssl, port 8729 by default) to check MikroTik router configuration for 22 named checks (MGMT-001 through WIFI-002), each returning severity, live evidence from the router, and a RouterOS fix command.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds --port flag to sara audit to target a non-standard RouterOS API port.
   • Adds --plaintext flag to sara audit to switch from api-ssl (port 8729) to the unencrypted api service (port 8728).
   • Adds sara cve <IP> <USERNAME> command to look up CVEs for the RouterOS version running on a connected router via the NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. API.
   • Adds sara cve --version <VERSION> to look up CVEs for any RouterOS version without connecting to a router.

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Transport migrated from SSH (Netmiko) to the RouterOS API (librouteros); routers must now have the api-ssl service (port 8729) enabled and an account with read and api policies — SSH-based connectivity no longer works.
2. v1.3.0 Dec 9, 2025 · release notes

   sara v1.3.0 adds audit profiles and manual RouterOS version CVE search, with a cleaner console output.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.3.0 https://github.com/caster0x00/sara.git
   # already have the repo? check out this version:
   $ git checkout v1.3.0

   • New audit profiles let you scope scans to system parameters only or protocol configurations only.
   • CVE search module now supports manually specifying a RouterOS version to search against.
   • Redesigned console output is cleaner and easier to read.
   • CVE report format is now more visual.

   4 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Password entry via command line arguments has been completely removed; authentication now requires interactive input via getpass.
3. v1.1 Mar 2, 2025 · release notes

   sara v1.1 shifts to live SSH analysis via Netmiko and adds CVE scanning, compromise artifact detection, and scheduler analysis for RouterOS.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.1 https://github.com/caster0x00/sara.git
   # already have the repo? check out this version:
   $ git checkout v1.1

   • Migrates analysis engine to live SSH sessions via Netmiko, removing dependency on .rsc configuration file imports.
   • Adds CVE-based vulnerability scanning that maps findings to known issues by RouterOS version.
   • Adds compromise artifact detection covering suspicious static DNS records, proxy settings, and exposed services.
   • Adds scheduler analysis to surface potentially malicious scheduled tasks and hidden configuration overwrites.
   • Extends RouterOS version support to cover newer releases.

   5 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The tool no longer operates on .rsc configuration files; existing workflows that pass .rsc files as input will break — a live SSH-accessible device is now required.