Présentation de Surface Watch
beta6 versions

Surface Watch — notes de version

Chaque version publiée de Surface Watch, de la plus récente à la plus ancienne, avec ce qui a changé — écrit au moment de la release, pas reconstitué après coup. Les notes elles-mêmes sont publiées en anglais.

Capturez chaque cible d'une mission de pentest avec REA et voyez sa surface d'attaque : endpoints, paramètres, statuts, en-têtes de sécurité et tiers. Comparez deux builds sans le bruit des chunks renommés ni des temps de réponse, transformez ce qui compte en findings appuyés par des preuves, et relancez un test pour savoir si chacun est corrigé. Tout tourne en local, avec une ligne de commande pour les surveillances planifiées.

Version actuelle

Version 0.1.6, publiée le 19 octobre 2026. C’est celle qu’installent les boutons de téléchargement ci-dessous.

Added

  • Surface Watch now includes a script to check for dynamic C runtime dependencies in Windows binaries, ensuring better compatibility across different systems.
macOS (Apple Silicon)Linux x86_64Windows

Gratuit pour un usage personnel, de recherche ou non lucratif, avec une mission et tous les onglets, la ligne de commande et les surveillances planifiées. L'usage commercial, y compris un consultant sur une mission client, nécessite Surface Watch Pro, qui garde aussi un nombre illimité de missions. Chaque build est produit par la CI de release et servi depuis mayorana.ch.

Toutes les versions

Surface Watch 0.1.5

Added

  • Surface Watch Pro. The free version keeps one engagement, with every tab, the command line and scheduled watches; Pro keeps any number, and is the licence for commercial use. Engagements already on your computer stay usable either way. Buy it on Surface Watch's page, then click Get Pro… next to the app's name, or run surfacewatch licence <key>. The key is checked on your computer: no account, nothing sent anywhere.

Fixed

  • On Windows and Linux, the Surface Watch window now shows its icon in the title bar, the taskbar and the app switcher, instead of a blank or generic one.

Surface Watch 0.1.4

Added

  • A sun/moon button at the top right switches between light and dark. Surface Watch still starts in the same mode as your computer and follows it when it changes, until you pick one with the button.

Surface Watch 0.1.3

Added

  • Export to api0 on the Surface tab, or surfacewatch export-api0, writes the API calls a frontend was seen making as an api0 catalog, ready to turn into MCP tools: one group per target, with each endpoint's method, path, path parameters, query parameters and request body fields. It combines the latest crawl with every HAR import, and leaves out static files, websockets and calls that come and go between runs. api0's identity headers stay off unless you tick My own backend. A warning reminds you that api0 api upload replaces every API in the workspace it uploads to.

Changed

  • Import HAR now keeps the names of the fields a request body sent (for example email and password on a login), never their values. Cookies, header values, body values and query values are still not kept. HAR files imported before this version have no field names; import them again to add them.

Surface Watch 0.1.2

Added

  • Suggest pages in the Watch tab finds the pages a target's own code declares, including hidden ones no link points to, such as an admin or accounting area. It opens the target once in a background browser, lists what it found, and adds the pages you tick to the crawl. Pages that need a value, like an order ID, are flagged instead of added. Also available as surfacewatch suggest-pages. With REA 6.4.0 it finds only a few routes; the next REA release finds them all.

Surface Watch 0.1.1

Added

  • Downloads for macOS (Apple Silicon, signed and notarized), Windows (installer) and Linux (x86_64 tarball with a setup script), plus the surfacewatch command line for each.
  • When a newer version is out, a banner at the top of the window says so, with a Download button for your system and the published SHA-256 so you can check the file. Set DISABLE_UPDATE_CHECK to turn the check off.
  • The version you are running is shown next to the app's name, top left.
  • Surface Watch is free for personal, research and non-profit use under the PolyForm Noncommercial licence; commercial use, including client work, needs a licence from Mayorana. The Windows installer shows the licence before installing.
  • First version. surfacewatch captures a web target through REA, crawling its pages in small batches, and shows its attack surface: endpoints with their parameters, statuses and security headers, plus the third parties the page talks to.
  • surfacewatch diff compares two captures and lists what actually changed: new and removed endpoints, changed parameters, statuses and headers, and third-party origins. Renamed script chunks, images and timing differences no longer show up as changes. Give it a second capture of the same build with --repeat and endpoints that come and go between runs are set aside and listed as unstable.
  • The Watch tab captures the selected target with Capture now and compares any two of its captures, by default the first one (the baseline) against the latest. Changes are grouped by kind, each with what it means for your testing: new endpoints to test, removed ones to check directly, new parameters to try for injection. Stability check captures the target a second time so endpoints that come and go between runs are set aside instead of showing up as changes. Captures are refused outside the engagement's test window.
  • The Surface tab shows what a capture saw of a target: every endpoint with its statuses and parameters, the scripts, and the third parties the page loads from. Entries worth a look are flagged and listed first: server errors, admin or debug paths that answer without a login, object IDs in the path to test for access control, and pages served without a Content-Security-Policy. Filter by path or show flagged entries only, and pick an older capture to see what it held. Promote turns any entry into a finding with a retest check, so issues that were there from the start no longer need a change to be recorded.
  • New engagement in the sidebar opens a form for the client, the test window, who authorised the test, and the first target: its origin, the pages to visit, and crawl settings. + Add target adds more targets to an engagement. The origin is checked as you type and shows exactly what is in scope; paths go in the pages list. An authorisation note is required, and the same rules apply to surfacewatch engagement add, which now needs --auth.
  • The Captures tab lists every capture of a target, newest first: when it was taken, whether it is a crawl, a stability repeat or a HAR import, how many endpoints and flagged entries it holds, the tools and versions behind it, its evidence, and which findings rely on it. Delete removes a capture and its stability repeats after you confirm, and says which findings will lose the raw data behind their evidence.
  • Import HAR in the Watch tab, or surfacewatch import-har, adds a recording from your browser's DevTools, Caido, ZAP or mitmproxy as a capture. It covers what the crawl cannot reach: logged-in pages, forms, a chat message sent. Cookies, header values, request and response bodies and query values are not kept; the capture cites the original file by its SHA-256, and the file stays where it is. The capture is dated by when it was recorded.
  • Comparisons stay crawl against crawl by default. Pick a HAR to compare it, and a note warns that a HAR and a crawl cover different ground. Retests use the newest capture of each kind that covers the finding, so a HAR of one flow does not turn a finding into "unknown".
  • Promote to finding on each change in the Watch tab turns it into a finding that cites the REA evidence of both captures.
  • The Findings tab lists an engagement's findings by severity. Edit the title, severity, description, remediation and CVSS vector in place; every change is saved as you go. Retest checks a finding against the target's latest capture and records the result with what the capture showed: fixed, still present, or unknown when the crawl did not reach it. An endpoint the crawl no longer sees is never reported as fixed, because it may still answer on the server. Findings no capture can confirm get their status set by hand.
  • Export Markdown writes a report of the engagement's findings, with their evidence, the tool versions behind each capture, and the retest history. surfacewatch findings <engagement> --retest --export does the same from the terminal or a scheduled job.
  • surfacewatch engagement add, target add, import and watch create engagements and targets, bring in existing REA captures, and capture a target and compare it with its baseline from the terminal or a scheduled job.
  • The Readiness tab checks Node.js, REA and your browser, and lists the known REA issues with the workaround applied for each. The app opens on it until you have a target to watch.

Le même historique, en JSON

Cette page est générée à partir d’un flux publié à côté des builds — le fichier que Surface Watch lit lui-même pour vérifier les mises à jour. Branchez-y un script si vous suivez les versions à l’échelle d’une équipe.

https://mayorana.ch/downloads/surface-watch/latest/releases.json

Une question sur cet outil ?

Renseignez-vous sur une licence commerciale pour votre équipe, signalez un problème ou dites-nous ce qui manque. Nous lisons chaque message.

Nous contacter