https://cybertoolchain.io/tools/sara New releases and features in sara, tracked by The Cyber Toolchain. en Sat, 10 Oct 2026 19:25:39 GMT https://github.com/ifritnoises/sara/releases/tag/v1.4.0 https://github.com/ifritnoises/sara/releases/tag/v1.4.0 Sat, 10 Oct 2026 19:25:39 GMT Sara v1.4.0 rewrites its audit engine over the RouterOS API with 22 structured checks and adds a CVE lookup mode.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `sara audit <IP> <USERNAME>` command that connects over the RouterOS API (`api-ssl`, port 8729 by default) to check MikroTik router configuration for 22 named checks (MGMT-001 through WIFI-002), each returning severity, live evidence from the router, and a RouterOS fix command.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--port` flag to `sara audit` to target a non-standard RouterOS API port. • Adds `--plaintext` flag to `sara audit` to switch from `api-ssl` (port 8729) to the unencrypted `api` service (port 8728). • Adds `sara cve <IP> <USERNAME>` command to look up CVEs for the RouterOS version running on a connected router via the NVD API. • Adds `sara cve --version <VERSION>` to look up CVEs for any RouterOS version without connecting to a router. • Migrates transport from SSH (Netmiko) to the RouterOS API (librouteros), dropping dependencies on `python3-netmiko` and `python3-packaging`. Breaking changes: • Transport migrated from SSH (Netmiko) to the RouterOS API (librouteros); routers must now have the `api-ssl` service (port 8729) enabled and an account with `read` and `api` policies — SSH-based connectivity no longer works. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sara https://github.com/caster0x00/sara/releases/tag/v1.3.0 https://github.com/caster0x00/sara/releases/tag/v1.3.0 Tue, 09 Dec 2025 12:37:31 GMT sara v1.3.0 adds audit profiles and manual RouterOS version CVE search, with a cleaner console output. • New audit profiles let you scope scans to system parameters only or protocol configurations only. • CVE search module now supports manually specifying a RouterOS version to search against. • Redesigned console output is cleaner and easier to read. • CVE report format is now more visual. Breaking changes: • Password entry via command line arguments has been completely removed; authentication now requires interactive input via `getpass`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sara https://github.com/caster0x00/sara/releases/tag/v1.1 https://github.com/caster0x00/sara/releases/tag/v1.1 Sun, 02 Mar 2025 18:47:10 GMT sara v1.1 shifts to live SSH analysis via Netmiko and adds CVE scanning, compromise artifact detection, and scheduler analysis for RouterOS. • Migrates analysis engine to live SSH sessions via Netmiko, removing dependency on .rsc configuration file imports. • Adds CVE-based vulnerability scanning that maps findings to known issues by RouterOS version. • Adds compromise artifact detection covering suspicious static DNS records, proxy settings, and exposed services. • Adds scheduler analysis to surface potentially malicious scheduled tasks and hidden configuration overwrites. • Extends RouterOS version support to cover newer releases. Breaking changes: • The tool no longer operates on .rsc configuration files; existing workflows that pass .rsc files as input will break — a live SSH-accessible device is now required. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sara