• Migrate to new workspace format. Existing workspaces are migrated automatically.
• Add pkg as a new command as a replacement for mod
• Add geo_polygon_contains, to check if a location is inside a polygon
• Improve sn0int select output
• Return true if uniq activity event is already known
• Add missing seccomp syscall (poll)
• Add str_find, str_replace and strval
• Add sn0int paths to show
• Add sn0int pkg to manage modules

• Websocket functions have been added
• http_send now returns the server ip address that was used
• sqlite performance has been improved by setting PRAGMA synchronous = NORMAL
• Socket timeout support has been improved

• Fix breaking changes in geoip download. GeoIP is still supported but sn0int isn't going to try to download it anymore.
• Activity logging: Allows modules to create events that are tied to a datetime and can have data tied to them. There's a proper frontend planned for this.
• Added ratelimit_throttle which behaves similar to a mutex that scripts can lock to get rate limited automatically according to the limit configured by the function arguments.
• Tab completion for sn0int repl
• Missing add subcommands have been added for urls and ports
• Minor improvements in the UI

• Added a very basic sn0int repl to make script development easier
• Added improved support for apis hosted on .onions
• Added crypto currency addresses as new struct
• Added sn0int export as a command to export a workspace to json
• The target option is now exposed on the cli to run an investigation on a subset of the structs in scope, this can be used with sn0int run -t 'where id=1' foo
• Improved normalization when adding structs
• Improved date functions (there are going to be deprecation warnings on the next release)
• Added stdin_read_to_end to read all of stdin into a string
• last_seen automatically selects the most recent date so scripts don't need to check this manually
• Fixed pgp uid decoding issue
• Minor bugfixes and improvements

• There is now an autonoscope engine that can automatically apply rules to exclude structs from scope when added
• quickstart and mod update are now much faster
• http_fetch and http_fetch_json have been added as a shorthand for http_send with status code validation and optionally parsing the body as json, reducing the boilerplate in a few modules
• tls support has been added to sock_connect
• pgp_pubkey can now return the primary key fingerprint and signatures
• netblocks have been added as a struct
• Modules can be listed by input source
• base64 and base32 functions have been added, with support for custom alphabets
• Startup time has been improve significantly
• noscope/scope are now exposed to the cli as sn0int noscope and sn0int scope
• set_err has been added for certain control-flow cases
• Some fields are now automatically lowercased
• Installed modules are now tagged with [installed] in the search results
• The module search got a --new flag to show only modules we haven't installed yet

• Add models for ports
• Add hmac and cryptographic hash functions
• Add strftime and strptime
• Add an xml parser and processing functions
• Add more advanced workspace options
• ipv4/ipv6 is now automatically detected and set for the ipaddr model
• warn and warn_once functions have been added
• Some seccomp bugfixes

• Resolve an issue on openbsd with std::env::current_exe

• Fix openbsd issues in 2 dependencies
• Add missing /dev/urandom to unveil policy

• Improve management of private modules
• Add support for images (including exif)
• Structs can now have blobs attached, the path can be queried with select --paths
• Improve various modules
• Add a displayname field for emails

• Added accounts structs to the database
• Added breach structs to the database
• Using >= and <= in queries now works correctly
• Unknown script metadata is now non-fatal
• Improved aarch64 support
• seccomp bugfix (mremap)

Note about the registry

The registry is currently difficult to build due to an unresolved problem in Rocket, if you are interested in deploying a registry please join the #sn0int irc channel for instructions.

Bugfix release

• Various seccomp fixes

• Add socket functions to create raw tcp connections (with socks5 support)
• Add db_add_ttl to add to the database with a timeout
• Add datetime function to get current time+date
• Add json output for select
• Don't display progress indicator in some cases
• Switch sqlite to WAL

New modules

• smtp-check - validate emails over smtp
• thunderbird-autoconfig - find subdomains via thunderbird autoconfig
• well-known-uris - test for RFC-5785 well-known uris
• passive-arp - similar to arp-scan but fully passive, depends on sniffglue

Bugfix release

• Fix a bug in the certificate parser for san extensions longer than 127 bytes
• Introduce a dns cache to reduce dns traffic and avoid a bug in chrootable-https that leaks udp sockets
• Bump dependencies to support OpenBSD

• Add socks5 support
• Add basic support for devices and networks
• Introduce help command
• Add necessary flags for selftest
• Exclude unneeded open syscall from sandbox
• Expose select to non-interactive mode

• Add phonenumber table
• Support fetching information about phonenumbers
• Add keyring for secret managment
• Add url_escape and url_unescape functions
• Add reverse dns fields to ipaddrs
• Add first url bruteforce script
• Merge security headers into registry codebase
• Port to rust 2018 edition

• Expose stdin to scripts if --stdin is set
• Bypass a recent sqlite 3.26.0 regression
• Introduce automatic fields based on other fields
• Adjust sandbox for arm
• List subdomains when listing domains
• Add debug function for output if -vv is set

Breaking

• Extend dns function to support axfr
• Fix indexing in lua scripts

• Allow running investigations concurrently
• swich_db has been replaced with a proper workspace command
• Add public documentation on readthedocs
• Add openbsd support
• Add benchmark for db_add speed
• Improve detection if in-scope and out-of-scope in passive spider
• Mute some error! calls from libs
• Add x509_parse_pem certificate parser
• db_add returns nil if entity is out of scope

• Add quickstart command to reduce new user on-boarding friction
• Improved upserting and update support
• Targets can be filtered and previewed
• Add db_select to test if something is already in scope
• Add mod update to update modules
• Improve support for redirects for urls
• Allow asn lookups with asn_lookup
• Allow publishing multiple scripts at once
• Allow deleting entities from the database
• Enable cascading delete

• Add shell completions for zsh, bash and others
• Introduce a config file
• Fix seccomp bug on alpine
• Add hackertarget-subdomains script
• Add scope/noscope commands
• Add db_update function
• Add geoip_lookup function
• Extend ipaddrs table with geoip columns
• Foreign keys are now correctly enforced

• Fix chrooted http bug
• Require modules to have an opensource license
• Add RFC4880 parser and PGP unarmoring
• Add email table
• Add regex support
• Improve error logging from scripts