🚀 la suite open-source di web security testing più avanzata dal punto di vista matematico per bug bounty hunter.
Application Stack
Traceroute
Fastly · CloudFront
Imperva · F5
Traefik · Envoy
Caddy · Varnish
Node · Ruby · Go
score = 0.5 + (ceil − 0.5) × conf
min-cost attack path · 7 technique nodes
7-dim feature vector per response
+ IntelligentBypassValidator
Mesi di ricerca e sviluppo condensati in v4.0.1-stable: due tool, una suite unificata, installati in un venv e richiamati direttamente:
security-traceroute https://target.com
security-crawler -v --wordlist-base ~/wordlists https://target.com --max-pages 200🧠 Cosa la rende diversa?
La maggior parte degli scanner lancia payload e conta le risposte. Questo ragiona.
Il motore è costruito su fondamenta matematiche formali:
→ Inferenza Bayesiana — ogni segnale infrastrutturale aggiorna la probabilità di bypass. Lo score è dinamico: 0.5 + (ceiling − 0.5) × confidence, con bonus di convergenza per ogni classificatore concorde. Nessuna percentuale hardcoded.
→ Teoria dei Grafi (DAG + A* + Dijkstra) — le catene di attacco sono Directed Acyclic Graph. Il planner trova il percorso a costo minimo verso il bypass con euristiche di dominio.
→ Entropia di Shannon — i body delle risposte vengono analizzati per information leakage. Bassa entropia post-probe = normalizzazione WAF = segnale di fingerprint.
→ Distanza di Mahalanobis — le risposte HTTP proiettate in spazio feature 7-dimensionale. La distanza tra fingerprint di layer espone le discrepanze di parsing tra CDN, WAF e backend.
→ Semantic Fingerprinting NLP-inspired — messaggi di errore classificati via fuzzy logic + ontologia. Il motore distingue semanticamente i tipi di blocco e adatta la strategia.
📊 Benchmark reali:
✅ 27 vulnerabilità — testphp.vulnweb.com — 21.7 min
✅ 15 vulnerabilità — DVWA — 18 min
✅ +114% detection rate vs v3.5
✅ 1.269 richieste HTTP — stabilità 99.9% — 76MB memoria media
Application Stack Traceroute — Installation & License Guide
This guide walks you through cloning the repository, setting up a Python virtual environment, installing the suite, and activating your complimentary license key.
Prerequisites
- Python 3.8 or higher
- Git
- An internet connection (required for license activation)
Verify your Python version:
python3 --version
Step 1 — Clone the Repository
git clone https://github.com/yourusername/application_traceroute.git
cd application_traceroute
Step 2 — Create and Activate the Virtual Environment
python3 -m venv venv
source venv/bin/activate
Your prompt will change to show (venv) — this confirms the environment is active. All subsequent commands must be run inside this environment.
Note: Every time you open a new terminal session you need to re-activate the environment before using the tools:
cd application_traceroute source venv/bin/activate
Step 3 — Install the Suite
With the virtual environment active, install the package in editable mode:
pip install -e .
This installs both tools and registers their entry points. Once complete, the following commands become available directly in your shell:
security-traceroute
security-crawler
Verify the installation:
security-traceroute --version
security-crawler --version
Step 4 — Activate Your License
The complimentary license key for LinkedIn readers is:
XXXX-XXXX-XXXX-XXXX
Run the activation command from within the virtual environment:
security-crawler --activate-license XXXX-XXXX-XXXX-XXXX
The tool will contact the license server, register your key, and confirm activation. If a license is already active on your machine, the existing activation slot is released automatically before the new key is registered — no manual deactivation required.
Check your license status at any time:
security-crawler --license-status
Expected output:
License type : Community (LinkedIn Promo)
Key : XXXX-XXXX-XXXX-XXXX
Status : Active
Activated on : 2026-03-28
Expires on : 2026-XX-XX
Days remaining : XX
Step 5 — Run Your First Scan
Infrastructure analysis:
security-traceroute https://target.com
Vulnerability scan:
security-crawler -v --wordlist-base ~/wordlists https://target.com --max-pages 100
Combined workflow (recommended):
# Step 1 — map the stack and generate bypass techniques
security-traceroute https://target.com
# Step 2 — scan using discovered bypasses
security-crawler https://target.com \
--wordlist-base ~/wordlists \
--bypass-file results/bypasses_target.com_*.json \
--max-pages 200
Authenticated scan:
security-crawler https://target.com \
--wordlist-base ~/wordlists \
--auth-type form \
--auth-login-url "https://target.com/login" \
--auth-username "your_user" \
--auth-password "your_password" \
--max-pages 200
Deactivating the Virtual Environment
When you are done, deactivate the environment with:
deactivate
Troubleshooting
security-traceroute: command not found The virtual environment is not active. Run source venv/bin/activate first.
pip install -e . fails with permission errors Make sure you are inside the virtual environment before running pip. Never use sudo pip inside a venv.
License activation fails — “unable to reach license server” Check your internet connection. If you are behind a proxy, set the standard HTTP_PROXY / HTTPS_PROXY environment variables before running the activation command.
License activation fails — “key already in use” The key has reached its activation limit. Contact me directly via LinkedIn message to request a reset.
This key is provided exclusively for readers of the LinkedIn announcement post. Authorized security testing only — always obtain explicit permission before scanning any target.
Solo per authorized security testing. Ottenere sempre la giusta autorizzazione prima di testare.
