Dev -> Stable 2.8.3 by TheTechromancer · Pull Request #2922 · blacklanternsecurity/bbot

TheTechromancer · 2026-02-24T16:13:41Z

Improvements

Bugfixes

Update nuclei to 3.7.0

Bumps [pymdown-extensions](https://github.com/facelessuser/pymdown-extensions) from 10.20.1 to 10.21. - [Release notes](https://github.com/facelessuser/pymdown-extensions/releases) - [Commits](https://github.com/facelessuser/pymdown-extensions/commits/10.21) --- updated-dependencies: - dependency-name: pymdown-extensions dependency-version: '10.21' dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [ruff](https://github.com/astral-sh/ruff) from 0.14.14 to 0.15.1. - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.14.14...0.15.1) --- updated-dependencies: - dependency-name: ruff dependency-version: 0.15.1 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [fastapi](https://github.com/fastapi/fastapi) from 0.128.6 to 0.128.8. - [Release notes](https://github.com/fastapi/fastapi/releases) - [Commits](fastapi/fastapi@0.128.6...0.128.8) --- updated-dependencies: - dependency-name: fastapi dependency-version: 0.128.8 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

pyenv needs `patch` to build Python from source, but it wasn't included in the Fedora dnf install list, causing the build to fail.

…/fastapi-0.128.8 Bump fastapi from 0.128.6 to 0.128.8

Fedora 43 replaces p7zip with native 7zip (v25.01), which rejects the literal -p"" argument passed via subprocess (exit code 2). The flag is unnecessary for unencrypted archives.

…to fix-fedora-test # Conflicts: # bbot/core/helpers/misc.py

Fix failing fedora distro test

Automated Docs Update

…/pymdown-extensions-10.21 Bump pymdown-extensions from 10.20.1 to 10.21

…/ruff-0.15.1 Bump ruff from 0.14.14 to 0.15.1

Bumps [werkzeug](https://github.com/pallets/werkzeug) from 3.1.5 to 3.1.6. - [Release notes](https://github.com/pallets/werkzeug/releases) - [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst) - [Commits](pallets/werkzeug@3.1.5...3.1.6) --- updated-dependencies: - dependency-name: werkzeug dependency-version: 3.1.6 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [ruff](https://github.com/astral-sh/ruff) from 0.15.1 to 0.15.2. - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.15.1...0.15.2) --- updated-dependencies: - dependency-name: ruff dependency-version: 0.15.2 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

…/werkzeug-3.1.6 Bump werkzeug from 3.1.5 to 3.1.6

…/ruff-0.15.2 Bump ruff from 0.15.1 to 0.15.2

…/mkdocs-material-9.7.2 Bump mkdocs-material from 9.7.1 to 9.7.2

Interactsh servers upgraded to v1.3.0 which uses AES-CTR encryption instead of AES-CFB. Update _decrypt() to match.

…-fix Fix interactsh decryption

bump version

improve padding oracle detection

github-actions · 2026-02-24T16:52:05Z

📊 Performance Benchmark Report

Comparing stable (baseline) vs dev (current)

📈 Detailed Results (All Benchmarks)

📋 Complete results for all benchmarks - includes both significant and insignificant changes

🧪 Test Name	📏 Base	📏 Current	📈 Change	🎯 Status
Bloom Filter Dns Mutation Tracking Performance	`5.46ms`	`4.23ms`	-22.6% 🟢🟢🟢	🚀
Bloom Filter Large Scale Dns Brute Force	`26.90ms`	`17.83ms`	-33.7% 🟢🟢🟢	🚀
Large Closest Match Lookup	`365.09ms`	`356.59ms`	-2.3% ⚪	✅
Realistic Closest Match Workload	`198.12ms`	`193.97ms`	-2.1% ⚪	✅
Event Validation Full Scan Startup Small Batch	`492.33ms`	`487.22ms`	-1.0% ⚪	✅
Event Validation Full Scan Startup Large Batch	`865.04ms`	`838.12ms`	-3.1% ⚪	✅
Make Event Autodetection Small	`32.59ms`	`31.11ms`	-4.5% ⚪	✅
Make Event Autodetection Large	`324.71ms`	`316.66ms`	-2.5% ⚪	✅
Make Event Explicit Types	`14.02ms`	`14.17ms`	+1.1% ⚪	✅
Excavate Single Thread Small	`4.211s`	`4.171s`	-0.9% ⚪	✅
Excavate Single Thread Large	`10.061s`	`9.937s`	-1.2% ⚪	✅
Excavate Parallel Tasks Small	`4.386s`	`4.315s`	-1.6% ⚪	✅
Excavate Parallel Tasks Large	`7.514s`	`7.410s`	-1.4% ⚪	✅
Is Ip Performance	`3.27ms`	`3.15ms`	-3.6% ⚪	✅
Make Ip Type Performance	`12.02ms`	`11.53ms`	-4.1% ⚪	✅
Mixed Ip Operations	`4.67ms`	`4.48ms`	-4.0% ⚪	✅
Typical Queue Shuffle	`75.22µs`	`60.48µs`	-19.6% 🟢🟢	🚀
Priority Queue Shuffle	`845.81µs`	`698.93µs`	-17.4% 🟢🟢	🚀

🎯 Performance Summary

+ 4 improvements 🚀
  14 unchanged ✅

🔍 Significant Changes (>10%)

Bloom Filter Dns Mutation Tracking Performance: 22.6% 🚀 faster
Bloom Filter Large Scale Dns Brute Force: 33.7% 🚀 faster
Typical Queue Shuffle: 19.6% 🚀 faster
Priority Queue Shuffle: 17.4% 🚀 faster

🐍 Python Version 3.11.14

codecov · 2026-02-24T17:26:23Z

Codecov Report

❌ Patch coverage is 97.73463% with 7 lines in your changes missing coverage. Please review.
✅ Project coverage is 92%. Comparing base (dc1fc46) to head (d71adb8).
⚠️ Report is 75 commits behind head on stable.

Files with missing lines	Patch %	Lines
bbot/modules/lightfuzz/submodules/crypto.py	83%	3 Missing ⚠️
.../test_step_2/module_tests/test_module_lightfuzz.py	99%	3 Missing ⚠️
bbot/core/helpers/web/envelopes.py	95%	1 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##           stable   #2922    +/-   ##
=======================================
+ Coverage      92%     92%    +1%     
=======================================
  Files         416     416            
  Lines       34398   34690   +292     
=======================================
+ Hits        31380   31648   +268     
- Misses       3018    3042    +24

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Add default WAF filter for lightfuzz

Automated Docs Update

Don't excavate PDFs

…-as-get Lightfuzz - Try POST as Get feature

Automated Docs Update

liquidsec and others added 30 commits September 9, 2025 10:44

add waf filter for lightfuzz

21677ac

language

80c8d09

more language

48fc845

lint

c02039d

add debug msg

db290f1

bugfix

8ffd223

fixing filter

a916802

ruff format

dcb404a

Update nuclei

0fabcc0

Merge pull request #2886 from blacklanternsecurity/update-nuclei

84bc532

Update nuclei to 3.7.0

[create-pull-request] automated change

65c33bd

fix fedora distro test: add missing patch dependency

5f8e677

pyenv needs `patch` to build Python from source, but it wasn't included in the Fedora dnf install list, causing the build to fail.

Merge pull request #2905 from blacklanternsecurity/dependabot/pip/dev…

ac39c2b

…/fastapi-0.128.8 Bump fastapi from 0.128.6 to 0.128.8

Merge branch 'dev' into dependabot/pip/dev/ruff-0.15.1

997c621

more fedora workflow fixes

6b8e3da

fix unarchive: remove -p"" flag for native 7zip compatibility

e01cc39

Fedora 43 replaces p7zip with native 7zip (v25.01), which rejects the literal -p"" argument passed via subprocess (exit code 2). The flag is unnecessary for unencrypted archives.

resolve symlinks in which() to fix native 7zip codec loading on Fedora

3d79949

Merge branch 'dev' into fix-fedora-test

2a86935

resolve symlinks in which() to fix native 7zip codec loading on Fedora

c2a93d8

Merge remote-tracking branch 'refs/remotes/origin/fix-fedora-test' in…

b60e7ae

…to fix-fedora-test # Conflicts: # bbot/core/helpers/misc.py

Merge pull request #2908 from blacklanternsecurity/fix-fedora-test

0fd43c6

Fix failing fedora distro test

Merge branch 'dev' into dependabot/pip/dev/ruff-0.15.1

015481f

Merge pull request #2901 from blacklanternsecurity/update-docs

0396b08

Automated Docs Update

new ruff

4ca0d34

Merge branch 'dev' into dependabot/pip/dev/pymdown-extensions-10.21

0e1e533

Merge pull request #2902 from blacklanternsecurity/dependabot/pip/dev…

b315a12

…/pymdown-extensions-10.21 Bump pymdown-extensions from 10.20.1 to 10.21

Merge pull request #2904 from blacklanternsecurity/dependabot/pip/dev…

4b2d721

…/ruff-0.15.1 Bump ruff from 0.14.14 to 0.15.1

dependabot Bot and others added 9 commits February 23, 2026 04:49

Merge pull request #2916 from blacklanternsecurity/dependabot/pip/dev…

58ce1f4

…/werkzeug-3.1.6 Bump werkzeug from 3.1.5 to 3.1.6

Merge pull request #2917 from blacklanternsecurity/dependabot/pip/dev…

68e6f6b

…/ruff-0.15.2 Bump ruff from 0.15.1 to 0.15.2

Merge pull request #2915 from blacklanternsecurity/dependabot/pip/dev…

f42fe3b

…/mkdocs-material-9.7.2 Bump mkdocs-material from 9.7.1 to 9.7.2

Fix interactsh decryption: switch from AES-CFB to AES-CTR

0ad651e

Interactsh servers upgraded to v1.3.0 which uses AES-CTR encryption instead of AES-CFB. Update _decrypt() to match.

Merge pull request #2919 from blacklanternsecurity/interactsh-upgrade…

eb548fd

…-fix Fix interactsh decryption

bump version

f0c7daa

Merge pull request #2921 from blacklanternsecurity/bump-version

f13e9b7

bump version

TheTechromancer requested a review from liquidsec February 24, 2026 16:13

Merge pull request #2911 from blacklanternsecurity/paddingoracle-fix

2a76775

improve padding oracle detection

liquidsec approved these changes Feb 24, 2026

View reviewed changes

liquidsec added 3 commits February 24, 2026 13:01

use cloudcheck waf tag instead of hardcoded provider list

40d0891

merge dev, resolve conflicts

cb65410

adding todo note

7d69afd

liquidsec approved these changes Feb 24, 2026

View reviewed changes

liquidsec and others added 9 commits February 24, 2026 16:30

Merge pull request #2712 from blacklanternsecurity/lightfuzz-performance

eb0f07c

Add default WAF filter for lightfuzz

[create-pull-request] automated change

6ecf4b3

Merge pull request #2924 from blacklanternsecurity/update-docs

7bb10ba

Automated Docs Update

Merge pull request #2913 from blacklanternsecurity/excavate-ignore-pdf

052e88e

Don't excavate PDFs

Resolve merge conflict with dev

8f2d4fc

Merge branch 'dev' into lightfuzz-try-post-as-get

7c02e70

Merge pull request #2914 from blacklanternsecurity/lightfuzz-try-post…

a62462b

…-as-get Lightfuzz - Try POST as Get feature

[create-pull-request] automated change

4af25ea

Merge pull request #2929 from blacklanternsecurity/update-docs

d71adb8

Automated Docs Update

liquidsec approved these changes Feb 26, 2026

View reviewed changes

ausmaster approved these changes Feb 26, 2026

View reviewed changes

TheTechromancer merged commit 24c720b into stable Feb 26, 2026
29 of 32 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Dev -> Stable 2.8.3#2922

Dev -> Stable 2.8.3#2922
TheTechromancer merged 67 commits intostablefrom
dev

TheTechromancer commented Feb 24, 2026 •

edited by liquidsec

Loading

Uh oh!

github-actions Bot commented Feb 24, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Feb 24, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

TheTechromancer commented Feb 24, 2026 • edited by liquidsec Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Improvements

Bugfixes

Uh oh!

github-actions Bot commented Feb 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📊 Performance Benchmark Report

🎯 Performance Summary

🔍 Significant Changes (>10%)

Uh oh!

codecov Bot commented Feb 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

TheTechromancer commented Feb 24, 2026 •

edited by liquidsec

Loading

github-actions Bot commented Feb 24, 2026 •

edited

Loading

codecov Bot commented Feb 24, 2026 •

edited

Loading