• Add missing seccomp syscall (clone3)
• Sandbox crash error message has been changed from EOF while parsing a value at line 1 column 0 to Sandbox child has crashed
• Support compiling for RISC-V 64-bit (#234, @SpriteOvO)
• Fixes related to path handling (#227, @stoeckmann)
• Reduce some heap allocation

Thanks

We'd like to thank @SantiagoTorres, @repi and @rgacogne for their support on github sponsors.

• Add missing seccomp syscalls (rt_sigaction, rseq)
• Update Dockerfile to alpine 3.15 and buildkit (you might need to export DOCKER_BUILDKIT=1)
• Fix some clippy warnings
• Fix a typo in an example module (#224, @ysf)

Thanks

We'd like to thank @SantiagoTorres, @repi and @rgacogne for their support on github sponsors.

• Fix seccomp issue with fstat

Thanks

We'd like to thank @SantiagoTorres and @repi for their support on github sponsors.

sn0int rescope -i

There've been commands for {scope,noscope,autoscope,autonoscope} for a while, scope/noscope sets entities to out-of-scope which automatically excludes them from further investigations, and autoscope/autonoscope is a system to automatically set things out-of-scope with a hierarchical rule set.

In the past there was no way to re-apply these rules to existing entities. This is now possible with the rescope command that's available both from the interactive cli and the commandline.

It defaults to non-interactive mode that shows a diff when applying the rules and asks for confirmation. -n is a dry-run to always reject the change, -y to automatically apply it and -i to interactively decide for each entity.

Besides the obvious y and n there's also:

• d (done) - apply the changes confirmed so far, skip the rest
• a (always) - apply all other changes matching this specific rule: if example.com matched noscope .com and you select a, example.com would be set out-of-scope and the next-up foobar.com would be automatically set out-of-scope without asking again
• x (never) - skip this change and all future changes matched by this rule

Thanks

We'd like to thank @SantiagoTorres and @repi for their support on github sponsors.

• Allow using run <module> interactively
• Allow setting a proxy with run -X <proxy>
• Add functions for perceptual image hashing
• Allow setting a different default user agent

Thanks

We'd like to thank @SantiagoTorres and @repi for their support on github sponsors.

• Support invoking shell commands with ! from readline
• The workspace can be selected with the SN0INT_WORKSPACE environment variable. Running shell commands with the new ! feature autoamtically sets this variable to the current workspace
• Bump dependencies

Thanks

We'd like to thank @SantiagoTorres and @repi for their support on github sponsors.

• Fix seccomp segfault with open on x86_64 musl
• Update dependencies
• Update dockerfile baseimage

Thanks

We'd like to thank @repi for their support on github sponsors.

• Fix build failure on aarch64 musl

Thanks

We'd like to thank @repi for their support on github sponsors.

• Added new stats command to show data in the workspace. This is also available as a subcommand with sn0int -w foo stats
• Add select --values as shorthand for jq -r .value
• Allow deleting multiple workspaces at once

Thanks

We'd like to thank @repi for their support on github sponsors.

• Speedup initial setup of a new workspace by 1242% (2913ms vs 217ms in my tests)
• Update dependencies (including security updates)

Thanks

We'd like to thank @repi for their support on github sponsors.

• Introduce stealth levels (loud, normal, silent, offline) that modules can specify and you can select which modules you want to enable based on the stealth level
• The author and repository can be added to module metadata
• Support inverse rules for notifications
• Some structs can now be streamed into the database from stdin with sn0int add --stdin
• The http functions now support redirects

Thanks

We'd like to thank @repi for their support on github sponsors.

Bugfixes in notification system

• Execution of a notification hook doesn't cause further queued executions to abort anymore.
• Ratelimits are now shared with notification modules as well so webhook ratelimits can be honored.

Thanks

We'd like to thank @repi for their support on github sponsors.

New Feature: calendar

Previous releases introduced activity as a new discoverable datapoint, there's now a new cal command to show a calendar that's annotated with a heat-map.

sn0int cal 2020

It's also possible to break them down to a specific time (-T) which defaults to 12 minute slices, or group by hour instead (-H). To -C to show additional days for context (this also works in the month view):

sn0int cal -TC3

New Feature: notify

There's a new notification system that you can hook into. Notifications are also just sent with regular sn0int modules that take -- Source: notifications as input, to get the list of notification modules that are currently installed run:

sn0int pkg list --source notifications

This enables you to run sn0int automatically and unattended to monitor infrastructure. A full walk-through of how to setup notification routing can be found here:

https://sn0int.readthedocs.io/en/latest/notifications.html

Please note that this feature is still very much work in progress.

Misc

• Add deprecation notice for mod command in favor of pkg
• Make pkg quickstart skip already installed modules
• Make sn0int more forgiving with accidential ^C
• Fix seccomp issues with sleep

Thanks

We'd like to thank @repi for their support on github sponsors.

• Fix incomplete osx 10.13 dns bugfix

• Work around issue with ipv6 dns resolvers on OSX 10.13
• Support patterns in pkg list
• Add select --count
• Improve error messages
• Fix a display issue with netblocks in detailed view

• Add functions to connect to mqtt broker
• Add decryption function for libsodium secret box
• Add binary support in http_request/http_send
• Fix a bug that prevented adding urls with empty body
• Switch docker container to alpine
• Do not error for read timeouts in sock_recvline
• Support geoip database path used by geoipupdate
• Replace quickstart with pkg quickstart
• Support more advanced time references in sn0int activity, like '1h ago'
• Change update check interval

• Fix seccomp build issues on aarch64
• Fix regression in x509_parse_pem (dependency downgraded and sent https://github.com/rusticata/x509-parser/pull/27)
• Add sn0int run --dump-sandbox-init-msg for sandbox debugging
• Add exit and quit to exit the sn0int cli

• Migrate to new workspace format. Existing workspaces are migrated automatically.
• Add pkg as a new command as a replacement for mod
• Add geo_polygon_contains, to check if a location is inside a polygon
• Improve sn0int select output
• Return true if uniq activity event is already known
• Add missing seccomp syscall (poll)
• Add str_find, str_replace and strval
• Add sn0int paths to show
• Add sn0int pkg to manage modules

• Websocket functions have been added
• http_send now returns the server ip address that was used
• sqlite performance has been improved by setting PRAGMA synchronous = NORMAL
• Socket timeout support has been improved

• Fix breaking changes in geoip download. GeoIP is still supported but sn0int isn't going to try to download it anymore.
• Activity logging: Allows modules to create events that are tied to a datetime and can have data tied to them. There's a proper frontend planned for this.
• Added ratelimit_throttle which behaves similar to a mutex that scripts can lock to get rate limited automatically according to the limit configured by the function arguments.
• Tab completion for sn0int repl
• Missing add subcommands have been added for urls and ports
• Minor improvements in the UI

• Added a very basic sn0int repl to make script development easier
• Added improved support for apis hosted on .onions
• Added crypto currency addresses as new struct
• Added sn0int export as a command to export a workspace to json
• The target option is now exposed on the cli to run an investigation on a subset of the structs in scope, this can be used with sn0int run -t 'where id=1' foo
• Improved normalization when adding structs
• Improved date functions (there are going to be deprecation warnings on the next release)
• Added stdin_read_to_end to read all of stdin into a string
• last_seen automatically selects the most recent date so scripts don't need to check this manually
• Fixed pgp uid decoding issue
• Minor bugfixes and improvements

• There is now an autonoscope engine that can automatically apply rules to exclude structs from scope when added
• quickstart and mod update are now much faster
• http_fetch and http_fetch_json have been added as a shorthand for http_send with status code validation and optionally parsing the body as json, reducing the boilerplate in a few modules
• tls support has been added to sock_connect
• pgp_pubkey can now return the primary key fingerprint and signatures
• netblocks have been added as a struct
• Modules can be listed by input source
• base64 and base32 functions have been added, with support for custom alphabets
• Startup time has been improve significantly
• noscope/scope are now exposed to the cli as sn0int noscope and sn0int scope
• set_err has been added for certain control-flow cases
• Some fields are now automatically lowercased
• Installed modules are now tagged with [installed] in the search results
• The module search got a --new flag to show only modules we haven't installed yet

• Add models for ports
• Add hmac and cryptographic hash functions
• Add strftime and strptime
• Add an xml parser and processing functions
• Add more advanced workspace options
• ipv4/ipv6 is now automatically detected and set for the ipaddr model
• warn and warn_once functions have been added
• Some seccomp bugfixes

• Resolve an issue on openbsd with std::env::current_exe

• Fix openbsd issues in 2 dependencies
• Add missing /dev/urandom to unveil policy

• Improve management of private modules
• Add support for images (including exif)
• Structs can now have blobs attached, the path can be queried with select --paths
• Improve various modules
• Add a displayname field for emails

• Added accounts structs to the database
• Added breach structs to the database
• Using >= and <= in queries now works correctly
• Unknown script metadata is now non-fatal
• Improved aarch64 support
• seccomp bugfix (mremap)

Note about the registry

The registry is currently difficult to build due to an unresolved problem in Rocket, if you are interested in deploying a registry please join the #sn0int irc channel for instructions.

Bugfix release

• Various seccomp fixes

• Add socket functions to create raw tcp connections (with socks5 support)
• Add db_add_ttl to add to the database with a timeout
• Add datetime function to get current time+date
• Add json output for select
• Don't display progress indicator in some cases
• Switch sqlite to WAL

New modules

• smtp-check - validate emails over smtp
• thunderbird-autoconfig - find subdomains via thunderbird autoconfig
• well-known-uris - test for RFC-5785 well-known uris
• passive-arp - similar to arp-scan but fully passive, depends on sniffglue

Bugfix release

• Fix a bug in the certificate parser for san extensions longer than 127 bytes
• Introduce a dns cache to reduce dns traffic and avoid a bug in chrootable-https that leaks udp sockets
• Bump dependencies to support OpenBSD