|
| 1 | +# Changelog |
| 2 | + |
| 3 | +All notable changes to CyberTools are documented here. |
| 4 | + |
| 5 | +Format: [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) · Versioning: [Semantic Versioning](https://semver.org/) |
| 6 | + |
| 7 | +--- |
| 8 | + |
| 9 | +## [Unreleased] |
| 10 | + |
| 11 | +### Added |
| 12 | +- **Hash Identifier** (`tools/hash-identifier/`) — heuristic identification of 50+ hash formats by length, charset, and structural prefix (MD5, SHA family, SHA-3, NTLM, LM, bcrypt, Argon2id/i/d, SHA-512crypt, SHA-256crypt, MD5crypt, phpass, scrypt, PBKDF2-Django, MySQL5, BLAKE2b, Whirlpool, RIPEMD-160, GOST, etc.). Returns top guesses with confidence %, hashcat mode reference, and security/use info. Anchor-pattern detection for empty-LM and empty-NTLM sentinel hashes. |
| 13 | +- **Examples sections** wired into 10 more tools (vigenere, classical-ciphers atbash/a1z26, frequency-analyzer, cipher-identifier, timestamp, sri-generator, totp, xor, email-header, jwt-attacks). 24/37 tools now have click-to-load examples; remaining 12 are libraries/file-input/generators that don't need examples; RSA uses key-gen button as example workflow. |
| 14 | + |
| 15 | +### Changed |
| 16 | +- **Build pipeline migrated from npm → pnpm** (per ADR-005). `pnpm-lock.yaml` replaces `package-lock.json`. `packageManager: pnpm@10.33.0` pinned in package.json. README install instructions updated. Faster installs (~3×) and stricter dependency resolution. No runtime change. |
| 17 | +- Added `pnpm audit:drift` script for one-command drift detection. |
| 18 | + |
| 19 | +--- |
| 20 | + |
| 21 | +## [3.0.0] — 2026-05-02 |
| 22 | + |
| 23 | +### Phase 4 — 12 new CTF & Pentest tools (37 total) |
| 24 | + |
| 25 | +#### Added |
| 26 | + |
| 27 | +**Classical Ciphers** |
| 28 | +- **Vigenère Cipher** (`tools/vigenere/`) — encrypt/decrypt with any ASCII key; Kasiski test finds repeated trigrams and computes GCD-derived key lengths; brute-forces key lengths 1–20 ranked by chi-squared English score |
| 29 | +- **Classical Ciphers** (`tools/classical-ciphers/`) — tabbed single-page tool: Atbash, Affine (a/b params + key validation), A1Z26, Polybius square, Rail Fence (n rails), Beaufort — each with encode/decode |
| 30 | +- **Frequency Analyzer** (`tools/frequency-analyzer/`) — mono-gram frequency chart vs expected English distribution, Index of Coincidence, chi-squared-ranked Caesar/ROT brute force across all 25 shifts |
| 31 | +- **Cipher Identifier** (`tools/cipher-identifier/`) — heuristic analysis of character set, length, spacing, and IoC produces a top-5 ranked list of likely cipher types with confidence % and links to relevant tools |
| 32 | + |
| 33 | +**Forensics** |
| 34 | +- **Email Header Analyzer** (`tools/email-header/`) — parses RFC 5322 headers; extracts all IP addresses from Received: hops; displays SPF/DKIM/DMARC pass/fail/none badges; renders ordered relay path timeline |
| 35 | +- **Magic Bytes Identifier** (`tools/magic-bytes/`) — identifies file types from the first 32 bytes using a 100+ signature database (PNG, JPEG, GIF, PDF, ZIP, RAR, 7z, ELF, PE/MZ, MP4, SQLite, DOCX, and more); shows first 64 bytes in hex+ASCII |
| 36 | +- **Strings Extractor** (`tools/strings-extractor/`) — extracts printable ASCII strings (min-length configurable) and UTF-16 LE strings from binary files; displays file offset for each string; highlights matches for URLs, emails, and IPs |
| 37 | + |
| 38 | +**Web App Pentest** |
| 39 | +- **Reverse Shell Generator** (`tools/reverse-shell/`) — 14 shell templates across Unix (Bash, Python 2/3, Perl, Ruby, Netcat, Netcat mkfifo, Socat, PHP, Node.js, Awk, OpenSSL), Windows (PowerShell TCPClient, PowerShell base64, CMD Bitsadmin), and Web Languages (JSP); auto-substitutes IP and PORT |
| 40 | +- **XSS Payload Library** (`tools/xss-payloads/`) — 45+ payloads across 7 contexts: HTML Body, HTML Attribute, JavaScript, URL, SVG, Filter Bypass, Polyglot; each with copy button and technique explanation |
| 41 | +- **SQLi Payload Library** (`tools/sqli-payloads/`) — 55+ payloads across 6 DBMS (MySQL, PostgreSQL, MSSQL, SQLite, Oracle) and 7 techniques (Auth Bypass, Union, Boolean, Time, Error, Stacked, Comment); dual-filter UI |
| 42 | +- **JWT Attacks Toolkit** (`tools/jwt-attacks/`) — alg:none/None/NONE variants; RS256→HS256 confusion attack (PEM public key as HMAC secret via WebCrypto); weak secret wordlist cracker with progress bar; kid header injection with preset SQL/path payloads; all in-browser via WebCrypto |
| 43 | + |
| 44 | +**OSINT** |
| 45 | +- **Google Dorks Builder** (`tools/google-dorks/`) — form-based builder for site:, filetype:, intitle:, inurl:, intext:, and custom operators with live query preview; 55+ preset dorks in 9 categories (Admin Panels, Open Directories, Config & Env, Databases, Login Pages, IP Cameras, Sensitive Files, Code & Repos, Network) |
| 46 | + |
| 47 | +#### Changed |
| 48 | + |
| 49 | +- `js/components.js` — CT.TOOLS expanded from 25 to 37 entries; CT.CATEGORIES expanded from 8 to 11 (added CLASSICAL CIPHERS, WEB APP PENTEST, OSINT) |
| 50 | +- `index.html` — tools grid expanded from 25 to 37 cards; count updated |
| 51 | +- `sitemap.xml` — 12 new tool URLs added with `<lastmod>2026-05-02</lastmod>` |
| 52 | +- `manifest.webmanifest` — shortcuts updated: added Reverse Shell Generator, JWT Attacks Toolkit, Vigenère Cipher, Frequency Analyzer, Google Dorks Builder |
| 53 | +- `service-worker.js` — bumped to `cybertools-v4`; all 12 new tool HTML files added to SHELL_FILES pre-cache list |
| 54 | +- `ROADMAP.md` — Phase 4 items marked complete; version bumped to v3.0.0 |
| 55 | + |
| 56 | +--- |
| 57 | + |
| 58 | +## [2.0.0] — 2026-05-01 |
| 59 | + |
| 60 | +### Phase 2 — 12 new Tier-S daily tools (25 total) |
| 61 | + |
| 62 | +#### Added |
| 63 | + |
| 64 | +- **RSA Encryption** (`tools/rsa/`) — RSA-OAEP encrypt/decrypt, RSA-PSS sign/verify, key pair generation (1024–4096 bit), PEM export (SPKI/PKCS8) |
| 65 | +- **XOR Cipher** (`tools/xor/`) — multi-byte repeating key, hex/base64 I/O, Shannon entropy analysis, byte-frequency bar chart |
| 66 | +- **TOTP Generator** (`tools/totp/`) — RFC 6238 / RFC 4226, HMAC-SHA1/256/512, live 30-second countdown bar, HOTP mode, pure-JS Base32 decoder |
| 67 | +- **HTML Entities** (`tools/html-entities/`) — encode/decode named (`&`), decimal (`A`), hex (`A`) modes; 40+ named entity map |
| 68 | +- **Cookie Decoder** (`tools/cookie-decoder/`) — parses Set-Cookie headers; flags missing HttpOnly (high), Secure (high), SameSite (medium), SameSite=None without Secure (high) |
| 69 | +- **HTTP Headers Analyzer** (`tools/http-headers/`) — weighted scoring for 11 security headers (CSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP, CORP, Cache-Control, X-Powered-By, Server) |
| 70 | +- **SRI Hash Generator** (`tools/sri-generator/`) — SHA-256/384/512 Subresource Integrity via WebCrypto; URL fetch + file drag-drop; generates ready-to-paste `<script>` and `<link>` tags |
| 71 | +- **Regex Tester** (`tools/regex/`) — live match highlighting with color-coded groups, global/i/m/s flags, capture group detail table, replace mode with `$1`/`$2` backreferences |
| 72 | +- **IP / CIDR Calculator** (`tools/cidr/`) — IPv4 and IPv6, network/broadcast/hosts/mask/binary, CIDR class and type, subnet splitter up to 256 child subnets |
| 73 | +- **Common Ports Reference** (`tools/ports/`) — 70+ TCP/UDP ports, RISKY/COMMON TARGET risk badges, live search by port, protocol, name, or description |
| 74 | +- **User-Agent Parser** (`tools/user-agent/`) — browser, OS, device type (mobile/tablet/bot/desktop), rendering engine; auto-loads current browser UA |
| 75 | +- **File Entropy Analyzer** (`tools/file-entropy/`) — Shannon entropy with per-64-byte-chunk canvas chart, entropy classification (encrypted/compressed/binary/structured/sparse), 256-bin byte frequency histogram |
| 76 | +- Two new sidebar categories: **WEB SECURITY** and **NETWORK & DNS** |
| 77 | +- `sitemap.xml` — 12 new tool URLs added |
| 78 | +- `manifest.webmanifest` — shortcuts updated to include TOTP, HTTP Headers, CIDR, Regex |
| 79 | +- `service-worker.js` — bumped to `cybertools-v3`, all 12 new tool HTML files pre-cached |
| 80 | + |
| 81 | +#### Changed |
| 82 | + |
| 83 | +- `index.html` — tools grid expanded from 13 to 25 cards; "Coming soon" placeholder section removed |
| 84 | +- `js/components.js` `CT.TOOLS` — 12 new tool entries added across encoding, crypto, jwt, web-security, network, forensics categories |
| 85 | +- `ROADMAP.md` — Phase 2 items marked complete; version bumped to v2.0.0 |
| 86 | + |
| 87 | +--- |
| 88 | + |
| 89 | +## [1.0.0] — 2026-04-29 |
| 90 | + |
| 91 | +### Phase 1 — Foundation rebuild |
| 92 | + |
| 93 | +Complete redesign from isolated CDN-based pages to a coherent, production-quality application shell. |
| 94 | + |
| 95 | +#### Added |
| 96 | + |
| 97 | +- **Design system** — CSS custom property tokens for dark (default) and light themes (`css/design-system.css`) |
| 98 | +- **Self-hosted Tailwind CSS** — replaced runtime CDN with locally built `css/tailwind.css` (zero CDN requests) |
| 99 | +- **Self-hosted fonts** — Inter and JetBrains Mono served as woff2 from `assets/fonts/` (no Google Fonts) |
| 100 | +- **Shell component system** — `js/components.js` injects shared nav, trust banner, categorized sidebar, and footer on every page |
| 101 | +- **Dark/light theme toggle** — persisted to `localStorage`, no flash of wrong theme on load |
| 102 | +- **Command palette** — `Ctrl+K` / `Cmd+K` fuzzy search across all tools with keyboard navigation |
| 103 | +- **Global keyboard shortcuts** — `/` search, `Ctrl+Enter` run, `Ctrl+Shift+C` copy, `g h` home, `g t` tools index, `?` help |
| 104 | +- **Smart detect** — `Ctrl+Shift+V` pastes from clipboard and suggests the relevant tool (JWT, Base64, SHA-256, etc.) |
| 105 | +- **Tool history** — last 10 visited tools shown in sidebar Recent section (localStorage, no data sent anywhere) |
| 106 | +- **URL-hash state sharing** — tool inputs can be encoded into the URL fragment for shareable links |
| 107 | +- **Progressive Web App** — `manifest.webmanifest` + `service-worker.js` with stale-while-revalidate caching; works fully offline after first visit |
| 108 | +- **CSP meta tag** — `default-src 'self'; script-src 'self'` enforced on every page |
| 109 | +- **New pages** — `privacy.html`, `about.html`, `tools-index.html` (searchable), `404.html` |
| 110 | +- **Static files** — `sitemap.xml`, `robots.txt`, `humans.txt` |
| 111 | +- **SECURITY.md** — full vulnerability disclosure policy, response timeline, scope, architecture notes |
| 112 | +- **PRIVACY.md** — expanded with data handling table, localStorage audit, DevTools verification steps, dependency table |
| 113 | +- **README.md** — full project description, tool table, local dev instructions |
| 114 | +- **CONTRIBUTING.md** — tool template, PR checklist, design system reference |
| 115 | +- **ROADMAP.md** — Tier S/A/B/C tool backlog |
| 116 | + |
| 117 | +#### Changed |
| 118 | + |
| 119 | +- All 6 existing tools refactored into the new shell: |
| 120 | + - `tools/base64/` — new design system layout, examples panel, "How it works" section |
| 121 | + - `tools/jwt-decoder/` — new layout, structured header/payload/signature output |
| 122 | + - `tools/hex-viewer/` — new layout, styled viewer table |
| 123 | + - `tools/steganography/` — new layout, styled drag-drop zone |
| 124 | + - `tools/rot/` — new layout, examples, auto-detect mode preserved |
| 125 | + - `tools/rc4/` — new layout + **legacy warning banner** (RC4 is cryptographically broken) |
| 126 | +- `index.html` — rebuilt hero, trust stats bar, tools grid with "Coming soon" placeholders |
| 127 | +- `css/global.css` — base resets, `@font-face` declarations, shell layout rules |
| 128 | + |
| 129 | +#### Removed |
| 130 | + |
| 131 | +- All `<script src="https://cdn.tailwindcss.com">` CDN script tags from every page |
| 132 | +- Hardcoded navigation headers from all tool pages (now injected by `components.js`) |
| 133 | + |
| 134 | +--- |
| 135 | + |
| 136 | +## [0.1.0] — 2025 (initial) |
| 137 | + |
| 138 | +Original release with 6 standalone tools: |
| 139 | + |
| 140 | +- Base64 Encoder/Decoder |
| 141 | +- JWT Encoder/Decoder |
| 142 | +- Hex Viewer/Editor |
| 143 | +- Steganography (LSB) |
| 144 | +- ROT Cipher (ROT1/5/13/18/47/48) |
| 145 | +- RC4 Encryption/Decryption |
0 commit comments