Metadata-Version: 2.4
Name: summit-scanner
Version: 1.3.0
Summary: Summit - open-source web security testing platform (proxy, scanner, fuzzer) by Pennacle Security
Author: Pennacle Security
License: MIT
Requires-Python: >=3.10
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: requests>=2.31
Requires-Dist: pyyaml>=6.0
Requires-Dist: packaging>=23.0
Dynamic: license-file

<p align="center">
  <img src="docs/assets/banner.png" alt="summit" width="760">
</p>

<p align="center">
  <a href="https://github.com/pennacle-security/summit/actions/workflows/tests.yml"><img src="https://github.com/pennacle-security/summit/actions/workflows/tests.yml/badge.svg" alt="CI status"></a>
  <a href="https://github.com/pennacle-security/summit/releases"><img src="https://img.shields.io/github/v/tag/pennacle-security/summit?label=release&color=2ea44f" alt="release"></a>
  <a href="https://pypi.org/project/summit-scanner/"><img src="https://img.shields.io/pypi/v/summit-scanner?label=pypi&color=306998" alt="PyPI"></a>
  <a href="https://www.bestpractices.dev/projects/15532"><img src="https://www.bestpractices.dev/projects/15532/badge" alt="CII Best Practices"></a>
  <a href="https://api.scorecard.dev/projects/github.com/pennacle-security/summit/badge"><img src="https://api.scorecard.dev/projects/github.com/pennacle-security/summit/badge" alt="OpenSSF Scorecard"></a>
  <a href="https://pennacle-security.github.io/summit/"><img src="https://img.shields.io/badge/docs-live-2ea44f" alt="docs"></a>
  <img src="https://img.shields.io/badge/python-3.10%2B-3776ab" alt="python 3.10+">
  <img src="https://img.shields.io/github/license/pennacle-security/summit?color=8b949e" alt="MIT license">
  <img src="https://img.shields.io/badge/dependencies-3%20FLOSS%20packages-8b949e" alt="three dependencies">
</p>

<p align="center">One scriptable CLI for web security testing: scanner, proxy, fuzzer, authorization testing, WAF analysis, link-hijack detection, race conditions and recon.<br>55+ checks across 11 families, plus 25 bundled YAML templates. Free where the equivalents are paid - by <a href="https://github.com/pennacle-security">Pennacle Security</a>.</p>

---

We use Burp and ZAP every day. We also kept wanting three things they are not: a scanner we can script against in CI, findings that tell us how sure they are, and a codebase small enough to read in one sitting. Summit now has 55+ checks across 11 families. Summit is that tool - v1.3.0, MIT, built in the open. Three dependencies (`requests`, `pyyaml`, `packaging`), all FLOSS, all standard.

**Full documentation:** [pennacle-security.github.io/summit](https://pennacle-security.github.io/summit/)

## Contents

1. [At a glance](#at-a-glance)
2. [Quick start](#quick-start)
3. [Proof, not promises](#proof-not-promises)
4. [Commands](#commands)
5. [Feature notes](#feature-notes)
6. [Anti false positives and false negatives](#anti-false-positives-and-false-negatives)
7. [Check catalog](#check-catalog)
8. [How summit compares](#how-summit-compares)
9. [Roadmap](#roadmap)
10. [Community and contributors](#community-and-contributors)
11. [Contributing and security](#contributing-and-security)
12. [Legal and license](#legal-and-license)

## At a glance

Capabilities that usually sit behind paid tooling, plus the scanning core:

| Capability | Summit | The usual route |
|---|---|---|
| Broken access control testing (BOLA/IDOR) | `summit authorize` | Autorize-style add-on / paid workflows |
| Hidden parameter discovery | `summit mine` | Param Miner-style add-on |
| OpenAPI-driven scanning | `summit scan --openapi` | add-ons |
| WAF fingerprinting + bypass probing | built in | partial / add-ons |
| Broken-link hijack detection | built in | paid extension |
| SQLi, XSS, redirect, traversal, takeover, host header, CORS | built in | core scanners (free) |
| Recon chain: subfinder -> httpx -> nmap | `summit recon` | manual gluing |
| Race condition detection | `summit race` | Burp Turbo Intruder (paid) |
| TLS certificate audit | `summit tls` | manual / sslscan |
| Rate limiting, retries, JWT/encoder toolkit | built in | add-ons / paid |
| CI-ready, confidence-labelled, CWE/CVE-tagged findings | the whole point | paid automation |
| SARIF + JUnit XML output | built in | paid reporting |
| Pre-built binaries (linux/amd64, arm64, windows) | every release | N/A |

Every finding carries a confidence label - `confirmed` (an observed fact), `likely` (strong evidence), `needs-manual` (a heuristic for a human to check) or `info` - and the label caps severity, so a guess can never pose as critical. That distinction runs through the entire tool.

## Quick start

```bash
git clone https://github.com/pennacle-security/summit.git
cd summit
pip install -e .
```

Python 3.10+. Dependencies: `requests`, `pyyaml`, `packaging` - all FLOSS, all standard.

**Install from PyPI:**

```bash
pip install summit-scanner
```

**Or from source:**

```bash
git clone https://github.com/pennacle-security/summit.git
cd summit
pip install -e .
```

**Pre-built binaries** available on every [release](https://github.com/pennacle-security/summit/releases):
- `summit-linux-amd64` - Linux x86_64 (Ubuntu 20.04+, Debian 11+, RHEL 8+)
- `summit-linux-arm64` - Linux ARM64 (AWS Graviton, Raspberry Pi 4+, Apple Silicon)
- `summit-windows-amd64.exe` - Windows 10+ / Windows Server 2019+

No Python installation required for binaries.

Then watch it work against a deliberately vulnerable local target:

```bash
python examples/vuln_app.py        # terminal 1 - the target (127.0.0.1 only)
summit scan http://127.0.0.1:8765  # terminal 2 - the scan
```

A fuller pass on a real engagement looks like this:

```bash
summit recon target.com --json recon.json                 # subdomains -> hosts -> ports
summit scan https://target.com --depth 2 --rate 10        # crawl + all checks
summit scan --openapi api-spec.json                       # API: scan what the spec admits to
summit authorize https://target.com/admin?user=1 \
  --role 'admin=Cookie: session=abc' \
  --role 'user=Cookie: session=xyz'                       # BOLA/IDOR testing
```

## Proof, not promises

Every claim on this page is reproduced by [`examples/evidence.py`](examples/evidence.py) - it runs the demo target live, measures each feature, and prints PASS/FAIL with the real numbers. CI executes it on every push; a claim that stops holding fails the build.

<details>
<summary>Latest measured run (<code>python examples/evidence.py</code>)</summary>

```text
[PASS] full scan: 20 seeded check families detected, zero false positives
       141 findings in 8.3s (1031 requests), missing=none, control link flagged=no, 48 finding(s) carry confidence=confirmed
[PASS] resource takeover fingerprint detected on the target's own 404
       Possible AWS S3 resource takeover | AWS S3: 'nosuchbucket'
[PASS] host header injection: marker domain echoed back by the app
       Host: summit-host-probe.example -> reflected (reset-link poisoning surface)
[PASS] CORS reflects an arbitrary origin with credentials allowed
       ACAO: https://summit-cors-probe.example; ACAC: true
[PASS] WAF bypass: naive filter blocks, tampered payload lands decoded
       raw payload -> HTTP 403 (blocked); URL-encoded once -> HTTP 200, payload reflected decoded: True
[PASS] CAPTCHA challenge detected (reported, not solved)
       /login -> reCAPTCHA via marker 'recaptcha/api.js'
[PASS] rate limiting: --rate 5 paces 12 requests to ~2.2s; unlimited runs free
       12 requests at rate 5 -> 2.20s (theoretical floor: 2.2s); 12 requests unlimited -> 0.02s
[PASS] concurrency on a latency-bearing target: 8 workers vs serial (best of 3)
       40 requests x 25ms latency: serial 1.16s -> parallel 0.17s (6.9x speedup)
[PASS] smart prioritizer ranks known-injectable parameters first
       probing starts with: [('query', 'search?query=laptop'), ('id', 'user?id=1'), ('url', 'example.com')]
[PASS] toolkit decodes JWT header/payload and states the signature is unverified
       signature NOT verified - decoding only
[PASS] update check compares versions numerically (0.3 < 0.10)
       is_outdated('0.3.0', '0.10.0') -> True; is_outdated('1.0.0', '0.9.9') -> False
[PASS] broken access control: admin panel served identically to a low-privilege role
       verdict=broken; finding=Broken access control (BOLA/IDOR candidate)
[PASS] hidden parameter mining finds the undocumented debug parameter, zero noise
       1 finding(s): ['debug'] (all confirmed reflections)
[PASS] openapi-driven scan: spec alone leads the engine to seeded SQLi and XSS
       2 spec target(s) scanned -> 17 findings, sqli-error=yes, xss-reflection=yes
[PASS] OS command injection: marker executed and echoed by the server
       semicolon: exec marker x2, control marker x1 | CWE-78
[PASS] server-side template injection: {{7*7}} came back as 49
       Jinja2/Twig: {{7*7}} -> 49 | CWE-1336
[PASS] CRLF injection: X-Summit-CRLF header materialized in the response
       X-Summit-CRLF: injected | CWE-113
[PASS] sensitive file exposure: /.env confirmed by content signature
       content signature: 'APP_KEY=' | CWE-538
[PASS] CVE detection: Apache/2.4.49 banner maps to known CVEs
       detect_cves('Apache/2.4.49') -> ['CVE-2021-41773', 'CVE-2021-42013']
[PASS] time-based SQL injection: reproducible delay detected and calibrated
       MySQL: baseline 0.00s, probes 0.25s, 0.25s (threshold 0.2s)
[PASS] GraphQL introspection detected on a production-looking endpoint
       POST /graphql -> HTTP 200 with __schema payload | CWE-200
[PASS] frontend CVE detection: jQuery 3.4.1 + WordPress 5.7.1 map to known CVEs
       ['CVE-2020-11023', 'CVE-2021-29447'] (body signatures: CVE-2020-11023, CVE-2021-29447 (3.4.1, 5.7.1))
[PASS] SSRF confirmed out-of-band: the server fetched our callback URL
       OOB hit received for token ssrfa07ddbd9ad91dbb5 after payload http://127.0.0.1:36683/ssrfa07ddbd9ad91dbb5; callback log: 21:54:00  GET    /ssrfa07ddbd9ad91dbb5  from 127.0.0.1  token=ssrfa07ddbd9ad91dbb5; redirector control: silent
[PASS] XXE: external entity resolved, local file content returned
       file content signature in response: 'root:x:0:0:' | CWE-611
[PASS] TRACE enabled: probe marker header echoed back
       TRACE http://127.0.0.1:8777 echoed X-Summit-Trace: summit-trace-probe-9f3c2a | CWE-693
[PASS] hardcoded AWS key in the client bundle: reported likely, value redacted
       AWS access key: AKIA4Q…XK3P | CWE-798
[PASS] DOM XSS candidate: location.hash flows into innerHTML (needs manual)
       source→sink: location.hash → innerHTML | CWE-79

evidence summary: 27/27 claims verified
```

</details>

A visual of a real scan against the demo target:

<p align="center">
  <img src="docs/assets/demo.png" alt="real summit scan output against the local demo target" width="760">
</p>

Reproduce everything yourself:

```bash
python examples/vuln_app.py    # terminal 1 - the target
summit scan http://127.0.0.1:8765
python examples/evidence.py    # re-verify every claim above
```

The demo seeds a *healthy* outbound link (`https://example.com`) as a negative control - it must never be reported, and CI asserts that alongside the seeded detections. Found something wrong anyway? [Report it](https://github.com/pennacle-security/summit/issues/new?template=bug_report.yml).

## Commands

| Command | What it does |
|---|---|
| `summit scan <url>` | crawl, then passive + active checks, link health, WAF analysis. The 25 bundled YAML templates run by default; `--no-templates` skips them. `--openapi` scans a spec instead of crawling. `--auto-html` writes an HTML report automatically; `--render` adds headless-Chromium JS rendering (`pip install playwright`). |
| `summit authorize <url...>` | BOLA/IDOR testing: compare responses between two roles. |
| `summit mine <url>` | hidden parameter discovery (~120 candidates, marker-based). |
| `summit fuzz <url>` | directory brute force with wildcard-baseline filtering. |
| `summit recon <domain>` | chain subfinder -> httpx -> nmap into one report. |
| `summit tls <host>` | certificate expiry / self-signed / legacy TLS version audit. |
| `summit proxy` | intercepting HTTP proxy with a SQLite site map. |
| `summit repeater <file>` | send a raw request file (Burp-style). |
| `summit encode` / `summit decode` | base64, URL, hex, JWT (decode-only, honestly unverified). |
| `summit race <url>` | fire a burst of concurrent requests to surface race windows. |
| `summit diff <before.json> <after.json>` | compare two scan reports: new, resolved, regressed (`--fail-on` for CI). |
| `summit oob` | out-of-band callback listener: HTTP callbacks plus a raw TCP JNDI channel; proves blind SSRF / Log4Shell / Shellshock / blind XXE with a real hit. |
| `summit templates` | list or validate the 25 bundled YAML check templates. `--tags` / `--severity` narrow the list, `--json` emits machine-readable metadata. |
| `summit setup` | interactive setup wizard; saves defaults to `~/.summit/config.json`. |
| `summit --check-update` / `--auto-update` / `--install-tools` | versioning and recon tool installer. |

Shared flags on scanning commands: `--workers`, `--rate` (requests/second ceiling), `--retries` (with `Retry-After` support), `--timeout`, `--delay`. CI gates: `--fail-on high` exits 1 when a reported finding is at or above that severity; add `--baseline previous.json` and only new or regressed findings count.

## Feature notes

**Authorization testing.** Requests each URL as a privileged and a low-privilege role, then compares. Verdicts: `enforced` (roles differ), `broken` (identical response for the low-privilege role - critical, `confirmed`), `partial` (same status, different body - `needs-manual`). Measured on the demo: the admin panel serves salaries to both roles, caught as `confirmed`.

**Hidden parameter mining.** Servers read parameters the HTML never mentions - debug switches, feature flags, internal overrides. ~120 candidate names are probed with unique markers; reflection findings are `confirmed`, status/size shifts are `needs-manual`. Measured: the demo's undocumented `debug` switch found as `confirmed`, the other candidates silent - zero noise.

**OpenAPI-driven scanning.** Every documented endpoint becomes a target, with path params filled from examples and defaults - no crawling, no guessing. Measured: the spec alone leads the engine to the seeded SQLi and XSS. JSON specs natively; YAML needs converting first (the dependency list stays at exactly one).

**WAF detection and bypass.** Tight vendor signatures for Cloudflare, AWS WAF, Akamai, Imperva, ModSecurity, Sucuri, F5 and Wordfence. When a filter blocks standard payloads, tamper variants (single/double URL-encoding, comment splitting, case alternation) are tried - and a bypass is reported only when the original payload lands **decoded** in the response. Measured: raw payload -> HTTP 403; encoded once -> HTTP 200, decoded.

**OS command injection, SSTI, CRLF, sensitive files, XPath, SSI.** Each ships with a hard confirmation rule: OS command injection uses an exec marker plus a control probe (a server that merely reflects input shows both markers; a server that executes shows the exec marker more often - measured `x2 vs x1`), SSTI requires `{{7*7}}` to come back as `49`, CRLF requires our injected header to materialize, sensitive files (`.env`, `.git/config`, cloud keys, Terraform state, dumps, backups) require a content signature - never just a 200, XPath requires a fresh XML parser error that the baseline did not contain, and SSI requires the `exec` marker to be printed **without** the raw directive (reflection alone never counts). Every finding is tagged with its CWE automatically (CWE-78, CWE-1336, CWE-113, CWE-538, CWE-643, CWE-96), and version banners are matched against an offline CVE database (spoofable banners stay `needs-manual`).

**Log4Shell, Shellshock and blind XXE, proven out-of-band.** A response body cannot prove a blind injection. With `--oob-listen`, summit sprays JNDI lookups into logged headers (`User-Agent`, `X-Forwarded-For`, `Referer`), a Shellshock function definition into `User-Agent`, and external entities at XML endpoints. The listener accepts both HTTP callbacks and raw JNDI/LDAP binds, and a finding is written only when the unique token arrives. No callback, no finding.

**YAML check templates, without leaving the CLI.** 25 Nuclei-style templates ship in the package and run by default: 18 new CVE/exposure checks (Apache 2.4.50 traversal, Flink, Grafana, Citrix, Pulse Secure, Fortinet SSL-VPN, F5 iControl, PHPUnit, PHP-CGI, Symfony profiler, Go pprof, Swagger UI, ASP.NET trace, ELMAH, Tomcat examples, phpMyAdmin setup, permissive crossdomain policy, WordPress XML-RPC) plus the core admin/actuator/Docker/Kubernetes/source-map/WP-JSON checks. The engine supports path lists, word/regex/status/DSL matchers, negative matchers, `stop-at-first-match`, `follow-redirects` and Nuclei placeholders. `--no-templates` skips them; `--templates FILE_OR_DIR` adds your own; `--template-tags`, `--template-exclude-tags` and `--template-severity` select a subset; `summit templates --json` inventories them.

**CI gates that separate old noise from new risk.** `summit scan ... --fail-on high` exits 1 when any reported finding is high or critical. Add `--baseline previous.json` and the gate only counts findings that are new or have regressed since that report - the failure your pipeline actually needs to act on. Reports are still written before the gate runs, and an unreadable baseline exits 2 rather than silently passing. The gate is deterministic, uses the same dedup key as `summit diff`, and keeps the exit-code contract stable for CI.

**CAPTCHA: detect, do not solve.** reCAPTCHA, hCaptcha, Cloudflare Turnstile and challenge pages are detected and reported. Solving them automatically is out of scope by design - that line does not move.

**Broken-link hijacking.** Every outbound link is health-checked: dead domains (DNS verified twice), parked domains (tight fingerprints), broken links (404/410), unreachable hosts, and private-target links - recorded but never fetched, so a hostile page cannot weaponize your scanner as an SSRF probe.

**Resource takeover fingerprints.** A 404 answered with a provider's unclaimed-resource page (AWS S3, GitHub Pages, Heroku, Azure, Shopify, Fastly, Pantheon, Tumblr, Surge, Bitbucket) is a takeover setup. Fingerprint-only: no DNS tricks, no active claiming, ever.

**Recon orchestration.** subfinder -> httpx -> nmap, whichever are installed, with defensive parsing: passive-DNS noise capped, per-tool timeouts degrade into notes, and a crashed nmap is reported as *failed* - never as "no open ports".

**Rate limiting and prioritization.** `--rate` is a thread-safe requests/second ceiling (measured: 12 requests paced to 2.20s at rate 5; 0.02s unlimited). A transparent scoring model orders high-signal parameters first - deterministic and auditable, deliberately not a "neural network" claim.

**Toolkit and updates.** JWT decode with an honest "signature NOT verified" note, base64/URL/hex both directions, numeric version comparison against GitHub releases (`0.3 < 0.10`), self-update from a git checkout.

## Anti false positives and false negatives

False positives waste your triage time. False negatives get clients breached. Summit engineers against both, and the evidence runner proves it:

| Mechanism | What it kills |
|---|---|
| **Two-stage XSS check** - a unique canary goes first; payloads only fire on parameters that actually reflect | payload noise on parameters that never reflect |
| **Baseline diffing** - every probe compared against the same request untouched | error strings already sitting in the page |
| **Divergence + baseline match** (boolean SQLi) - `AND 1=1` must match the baseline, `AND 1=2` must differ | pages that simply vary per request |
| **Wildcard baseline** (fuzzer) - a random nonexistent path is measured first | "everything returns 200" servers flooding the report |
| **DNS double-check** (linkcheck) - a host must fail to resolve twice | transient resolver hiccups becoming fake hijack reports |
| **SSRF guard** - private/link-local/metadata ranges recorded, never fetched | your scanner weaponized against internal networks |
| **Tamper honesty** (WAF bypass) - requires the payload decoded in the response | bypass reports that would not survive a browser |
| **Tracker/opaque param filter** - `utm_*`, `fbclid`, 40+ char tokens never probed | wasted requests and padded reports |
| **Negative control in CI** - a healthy link that must stay unreported, asserted every push | silent regressions into false-positive territory |
| **Scope lock** - the spider never leaves the target host | crawling half the internet, and legal exposure |
| **Confidence labels + severity caps** - fact, strong likelihood or needs-manual, and the label caps severity | one flat "everything is critical" triage queue |
| **Unbreakable probe hosts** - `.example` cannot resolve | third-party callbacks and accidental DoS |

## Check catalog

| Check | Type | Severity | Confirmation basis |
|---|---|---|---|
| Missing security headers | passive | low | header absence |
| Cookie flags (Secure / HttpOnly / SameSite) | passive | low | header parse |
| SQL error / stack-trace disclosure | passive | low | baseline-diffed signatures |
| Server and tech version disclosure | passive | info | header parse |
| CORS wildcard with credentials | passive | low | header parse |
| Email exposure | passive | info | regex |
| WAF fingerprint | passive | info | tight vendor signatures |
| CAPTCHA / anti-bot challenge | passive | info | challenge markers, reported not solved |
| Resource takeover signature | passive | high | provider unclaimed-resource page on 404 -> `confirmed` |
| CNAME-level subdomain takeover | dns | critical | dangling CNAME resolves to an unclaimed service -> `confirmed`, CWE-350 |
| SQL injection, error-based | active | critical | fresh DB error vs baseline -> `confirmed` |
| SQL injection, boolean-based | active | medium | response divergence -> `likely` |
| SQL injection, time-based blind | active | medium | calibrated delay reproduced on every probe -> `likely` |
| GraphQL introspection enabled | passive-origin | low | real `__schema` payload -> `confirmed` |
| Reflected XSS | active | high | canary + raw payload reflection -> `confirmed` |
| DOM XSS candidate (source->sink in inline JS) | active | low | `location.hash` flows into `innerHTML` -> `needs-manual`, CWE-79 |
| WAF filter bypass | active | high | tampered payload lands decoded -> `confirmed` |
| Host header injection | active | high | marker domain echoed vs baseline -> `confirmed` |
| HTTP parameter pollution | active | medium | both injected markers land, in order -> `confirmed`, CWE-235 |
| CORS origin reflection | active | high | arbitrary origin reflected + credentials -> `confirmed` |
| OS command injection | active | critical | exec marker outruns control marker -> `confirmed`, CWE-78 |
| Server-side template injection (RCE) | active | critical | `{{7*7}}` evaluates to 49 -> `confirmed`, CWE-1336 |
| CRLF injection / response splitting | active | high | injected header materializes -> `confirmed`, CWE-113 |
| TRACE method enabled (XST surface) | active | high | marker header echoed back by TRACE -> `confirmed`, CWE-693 |
| Risky HTTP methods advertised | active | medium | Allow header lists TRACE/PUT/DELETE -> `likely`, CWE-650 |
| Sensitive file exposure (.env, .git, cloud keys, dumps, backups) | passive-origin | high | content signature, not just a 200 -> `confirmed`, CWE-538 |
| XXE (file disclosure via external entity) | active | high | local file content returned via entity -> `confirmed`, CWE-611 |
| SSRF (out-of-band confirmed) | active | high | listener received the callback -> `confirmed`, CWE-918 |
| Hardcoded secret in client-side code | passive | medium | vendor pattern + entropy, redacted -> `likely` (private keys `confirmed`), CWE-798 |
| Known CVE in version banner | passive | low | offline CVE database match -> `needs-manual` (banners spoof) |
| Open redirect | active | medium | 3xx Location to probe host -> `confirmed` |
| Path traversal | active | high | OS file indicators -> `confirmed` |
| XPath injection | active | high | fresh XML parser error vs baseline -> `confirmed`, CWE-643 |
| Server-side includes injection | active | high | `exec` marker printed without the raw directive -> `confirmed`, CWE-96 |
| Log4Shell (JNDI, OOB-confirmed) | active | critical | JNDI lookup reached our raw listener -> `confirmed`, CWE-917 |
| Shellshock (Bash, OOB-confirmed) | active | critical | crafted header triggered a callback -> `confirmed`, CWE-78 |
| Blind XXE (OOB-confirmed) | active | high | external entity fetched by the target -> `confirmed`, CWE-611 |
| Broken access control (BOLA/IDOR) | authorize | critical | identical response for low-privilege role -> `confirmed` |
| Email/user enumeration | active | medium | differential response for unknown identities -> `likely` |
| Directory listing | passive-origin | medium | "Index of /" content signature -> `confirmed` |
| Cacheable sensitive response | passive | low | sensitive marker + no Cache-Control -> `needs-manual` |
| Security headers grade | passive | info | deterministic A..F roll-up |
| Form missing CSRF token | passive-origin | medium | POST/password form without CSRF field -> `likely` |
| Hidden parameter (reflected) | mine | medium | unique marker reflected -> `confirmed` |
| Hidden parameter (behavior) | mine | low | status/size shift -> `needs-manual` |
| Link to dead domain (hijack) | linkcheck | high | DNS failure, verified twice -> `confirmed` |
| Link to parked domain (hijack) | linkcheck | high | tight parking fingerprints -> `confirmed` |
| Broken outbound link | linkcheck | medium | HTTP 404/410 -> `confirmed` |
| Unreachable outbound link | linkcheck | low | fails after retry -> `likely` |
| Outbound link to private IP | linkcheck | info | DNS resolution -> `confirmed`, never fetched |
| TLS certificate expired / self-signed | tls | high-medium | certificate dates and issuer -> `confirmed` |
| Legacy TLS versions accepted | tls | medium | handshake completed with TLSv1.0/1.1 -> `confirmed` |
| Directory fuzz | fuzz | info | status + wildcard baseline |

## How summit compares

| | summit | ZAP | Burp Suite |
|---|---|---|---|
| Price | free, MIT | free | paid core |
| UI | CLI + HTML/JSON reports | full GUI | full GUI |
| Scriptable in CI | yes, that is the point | add-ons | paid automation |
| Confidence-labelled findings | yes | partial | partial |
| Authorization testing (Autorize-style) | built in, scriptable | add-on | paid workflows |
| Hidden parameter mining (Param Miner-style) | built in | add-on | add-on |
| OpenAPI-driven scanning | built in | add-on | add-on |
| WAF detection + bypass probing | built in | partial | partial |
| Broken-link hijacking | built in | add-on | paid extension |
| Rate limiting | built in, thread-safe | add-on | paid |
| JWT/encoder toolkit | built in | add-on | built in |
| Takeover fingerprints, host header, CORS | built in | add-ons | add-ons |
| Codebase you can audit in an afternoon | ~7.5k lines | large | closed source |
| TLS-intercepting proxy | on the roadmap | yes | yes |
| Race condition detection | `summit race` | add-on | paid (Turbo Intruder) |
| TLS certificate audit | `summit tls` | add-on | built in |
| SARIF output | built in | no | no |
| Pre-built binaries per release | yes | no | no |

We are not trying to replace either of them. Summit is the small tool you drop into a pipeline or onto a VPS box, and the codebase you can actually read line by line.

## Roadmap

- [ ] TLS interception in the proxy (generated CA)
- [x] ~~POST form and JSON body injection points~~
- [x] ~~Authenticated scanning (cookies, headers)~~
- [x] ~~CNAME-level subdomain takeover (DNS resolution + service verification)~~
- [x] ~~Plugin API for custom checks~~
- [x] ~~Request interception UI~~
- [x] ~~Collaboration server (out-of-band detection via HTTP callbacks)~~
- [x] ~~Headless browser integration (JS rendering + DOM-based XSS)~~
- [x] ~~Scan diffing (compare scans over time)~~
- [ ] Scan scheduling

## Community and contributors

A repository that helps people back grows through word-of-mouth:

- **Questions** -> [Q&A discussion](https://github.com/pennacle-security/summit/discussions/categories/q-a) - beginner questions welcome, answered gladly
- **Ideas & roadmap votes** -> [Ideas](https://github.com/pennacle-security/summit/discussions/categories/ideas)
- **Show what you scanned** -> [Show and tell](https://github.com/pennacle-security/summit/discussions/categories/show-and-tell)
- **Your first contribution** -> [good first issues](https://github.com/pennacle-security/summit/labels/good%20first%20issue) come with step-by-step instructions
- First issues and PRs get a personal review and a spot below; the welcome bot says hello too

If summit saved you time on an engagement, a star helps the next person find it.

<!-- ALL-CONTRIBUTORS-LIST:START - Do not remove or modify this section -->
<!-- prettier-ignore-start -->
<!-- markdownlint-disable -->

<table>
  <tbody>
    <tr>
      <td align="center" valign="top" width="14.28%"><a href="https://github.com/SakarPaisen"><img src="https://avatars.githubusercontent.com/u/141169555?v=4?s=100" width="100px;" alt="SakarPaisen"/><br /><sub><b>SakarPaisen</b></sub></a><br /><a href="https://github.com/pennacle-security/summit/commits?author=SakarPaisen" title="Code">💻</a></td>
      <td align="center" valign="top" width="14.28%"><a href="https://github.com/mrvi0"><img src="https://avatars.githubusercontent.com/u/196581611?v=4?s=100" width="100px;" alt="mrvi0"/><br /><sub><b>mrvi0</b></sub></a><br /><a href="https://github.com/pennacle-security/summit/commits?author=mrvi0" title="Code">💻</a></td>
    </tr>
  </tbody>
</table>

<!-- markdownlint-enable -->
<!-- prettier-ignore-end -->
<!-- ALL-CONTRIBUTORS-LIST:END -->

## Contributing and security

PRs welcome - the [contributing guide](https://github.com/pennacle-security/.github/blob/main/CONTRIBUTING.md) covers the process, and adding a scan check is roughly thirty lines if you follow the pattern. [examples/vuln_app.py](examples/vuln_app.py) gives you a live target to test against.

Security issues go through private disclosure only. Details in the [security policy](https://github.com/pennacle-security/.github/blob/main/SECURITY.md).

## Legal and license

Summit is built for authorized security testing: your own systems, or systems you have written permission to test. We are not responsible for misuse. Licensed under [MIT](LICENSE).
