# burp-cli — Changelog

## v1.0.0 — 2026-06-25

Initial release. Fourteenth tool in the "productivity-boost" series.
Scope-locked per the 2026-06-23 memory note: **CLI MITM proxy +
history + jfind/v1 export, no GUI, no scan engine, no extension API.**

### v1.0 scope (what's IN)

- **HTTP proxy** — accepts proxy-style and origin-form requests on
  `--listen <addr>`, forwards upstream via `reqwest::blocking`, sends
  the response back, logs the full transaction (headers + body,
  base64) to `$XDG_DATA_HOME/cli-johlem/burp-cli/transactions.jsonl`.
- **HTTPS CONNECT tunnel** — passes encrypted bytes through
  unchanged with `tokio::io::copy_bidirectional`. NOT MITM in v1.0 —
  the body is opaque and not logged.
- **History** — `history list` (latest N transactions), `history show
  <id>` (full request + response detail; truncated body preview, JSON
  dump for binary).
- **Replay** — `replay <id>` re-sends a recorded HTTP request and
  prints the resulting status + body size + elapsed.
- **Export** — `export -F jfind` emits jfind/v1 records for the
  transactions that classify (admin / data-exposure / network-exposure
  patterns).
- **CA generation** — `cert ca-generate` produces a self-signed root
  CA under `$XDG_DATA_HOME/cli-johlem/burp-cli/ca/` (`ca.pem` +
  `ca.key`, 0600). Operators can pre-install it now so v1.1's `--mitm`
  flag activates without rotating identity.

### v1.0 scope (what's OUT — explicit memory contract)

- No GUI.
- No scan engine.
- No extension API.
- No HTTPS interception in the proxy loop (CONNECT is pass-through
  only). The CA exists for v1.1.

### Classification → jfind/v1

| Trigger | Category | Severity |
|---|---|---|
| Response body contains private-key markers or known token prefixes (xoxb-, ghp_, AKIA, BEGIN RSA PRIVATE KEY, …) | `data-exposure` | High |
| Response body contains password / api_key / client_secret / bearer literal | `data-exposure` | Medium |
| Path matches `/admin /manage /console /phpmyadmin /kibana /grafana /actuator /swagger /graphql /.git /.env` and status is 2xx/3xx | `network-exposure` | Medium |
| Same paths returning 401 / 403 | `network-exposure` | Low |
| Otherwise | skipped (not exported) |

Controls (always): DORA Art. 9 + ISO/IEC 27001:2022 A.8.16. Plus for
`data-exposure`: DORA Art. 9(4)(c) + NIS2 Art. 21(2)(g) + ISO 27001
A.8.24. Plus for `network-exposure`: DORA Art. 11 + NIS2 Art. 21(2)(b)
+ ISO 27001 A.8.21. MITRE T1552 / T1552.001 on data-exposure, T1595
on network-exposure.

### Authorisation reminder

burp-cli sends real HTTP traffic to whatever target the proxied
client requests. **ALWAYS verify written authorisation to test the
target before pointing a browser at it.** The proxy itself does NOT
enforce target allow-listing — that's an operator-process control.

### Exit codes

```
0  ok
2  usage (clap)
3  runtime (bind failure, parse, upstream error, unknown transaction)
```

### Build

- Library crate + thin CLI binary.
- 4 unit + 11 integration tests = 15 tests, all green.
- Zero compiler warnings.
- HTTP wire via `httparse` (no hyper version gymnastics).
- TLS via `rustls` (through `reqwest` for the upstream forward).
- CA generation via `rcgen` 0.13.
- Concurrency via `tokio` (Semaphore bounds in-flight connections).

### Suite interop

| Producer | Consumer | Use case |
|---|---|---|
| operator's browser | burp-cli | proxy through, record transactions |
| burp-cli | complymap | jfind findings → control mapping |
| burp-cli | dossier   | pentest report |
| burp-cli | notify    | dispatch data-exposure to Slack |

### Deferred to v1.1

- **HTTPS MITM** — wire the v1.0 CA into the proxy loop, generate
  per-host leaf certs on the fly, terminate TLS as server + client.
- Body-content regex match (today: status + path + secret-needle).
- Per-host scope allow-list (`--scope example.com,*.api.example.com`).
- Replay with mutated request (today: replay verbatim only).
- Keep-alive forwarding (today: every connection closes after one
  request).
- HTTP/2 + HTTP/3 explicit toggle.