Waymap Changelog

AI/LLM Integration

• AI Adaptive Payload Generation — Context-aware, WAF-evading payloads for SQLi, XSS, CMDi
• AI False Positive Reduction — Confidence scoring and automated analysis of findings
• AI Attack Surface Discovery — Leverage AI to find hidden endpoints from HTML/JS
• AI Result Analysis & Remediation — Severity justification and mitigation steps
• Multi-provider support: Groq, Cerebras, OpenAI (up to GPT-5), Anthropic (up to Claude Opus 4.8), Ollama, NVIDIA

SQLi Scanner & Database Enumeration

• New SQLi techniques: Union-Based, Stacked-Queries, and Inline-Query injections
• Database Enumeration engine — Automated database, table, and column extraction
• Improved payload injection accuracy and error detection patterns
• Better baseline timing for time-based SQLi

Crawler & Architecture Improvements

• Improved crawling efficiency and high-speed page discovery
• Better target parameter extraction and deduplication mapping
• Event Bus system for real-time finding emission
• Reconnaissance Intelligence Engine — Passive, active, and deep recon
• Fingerprint Engine — Intelligent request deduplication and URL normalization
• Enhanced HTTP layer with retry logic and connection pooling

Stability & Security Hardening

• Thread-safe result saving — New ResultManager with file locking; all modules save findings safely under concurrent scans
• Secure XML parsing — SQLi and CMDi modules use defusedxml to prevent XXE
• Time-based SQLi baseline — Baseline request timing reduces false positives
• Fixed config paths — Data/session paths resolve relative to the project root, not the current working directory
• Windows Unicode fix — Banner and UI render correctly on Windows terminals
• defusedxml dependency added and enforced in requirements.txt

Critical Bug Fixes

• Fixed SQLi payload injection — Boolean SQLi correctly injects into URL parameters instead of appending to the URL
• Fixed error-based SQLi — Removed logic that stripped single quotes from payloads
• CRLF detection — Checks both response headers and body for injected markers
• Open redirect — Uses requests instead of curl (works on Windows without external tools)
• CMDi URL building — Proper query-string reconstruction instead of fragile string replace
• Report loading fixed — Session JSON is correctly parsed for HTML/CSV/Markdown/PDF reports
• WAF module import fixed — --check-waf uses the correct module path

All Scanner Modules Updated

• All modules now use centralized ResultManager for thread-safe saving
• Updated: sqli · xss · lfi · cmdi · rce · ssti · cors · crlf · open-redirect
• Updated: advanced · wpscan · recon/misconfig modules

New Modules

• Recon foundation suite
• Misconfiguration & exposure suite
• Redirect / header injection suite
• Advanced injection suite (SSRF/XXE/HPP/Traversal/NoSQL/etc.)
• GraphQL security suite
• Auth / API logic checks
• Cache & request smuggling checks
• WordPress extras + optional checks

Changes

• Removed High/Critical profile pages from docs in favor of module-based scans
• Improved CLI usage documentation

Complete UI/UX Overhaul

• Unified interface across all 15 scan modules
• Consistent cyan headers with professional formatting
• Standardized icons and color scheme
• Uniform user prompts and messages
• Completion messages for all scans

Critical Bug Fixes

• Fixed JSON structure inconsistencies causing crashes
• Resolved circular import issues
• Fixed missing verbose parameter in LFI and CMDi
• Added missing datetime import in error-based SQLi
• Fixed result saving across all modules

Enhanced Features

• Consistent threading across all modules
• Graceful KeyboardInterrupt handling
• Verbose mode standardization
• Proper stop_scan event handling
• Improved error messages and logging

Modules Standardized (15/15)

• Injection Scans: LFI, CMDi, SSTI, CRLF, CORS, Open Redirect, XSS
• SQL Injection: Boolean-based, Error-based, Time-based
• Orchestrators: SQL Orchestrator, XSS Module