clickhouse

Rspamd 4.0.0 ships memory savings, a new scan protocol, and a required migration step The open-source spam filtering platform Rspamd released version 4.0.0, delivering infrastructure changes across its scan protocol, memory model, hash storage, and configuration system. Several of the changes are breaking, and at least one requires a migration step before upgrade. A new scan protocol The release introduces a /checkv3 endpoint that replaces HTTP headers with structured JSON or msgpack for metadata transport. The new endpoint uses multipart/form-data for requests and multipart/mixed for responses, supports per-part zstd compression, includes an optional body part for rewritten messages, and uses zero-copy piecewise writev for response output. Operators can activate the new protocol with the rspamc --protocol-v3 or rspamc --msgpack flags. The previous protocol remains available. Fasttext goes built-in, cuts memory use Rspamd previously depended on an external C++ libfasttext library. Version 4 removes that dependency and replaces it with a built-in mmap-based shim that loads model data into shared memory across all worker processes. The change eliminates per-worker heap copies of model data, which the project estimates saved between 500MB and 7GB of RAM in multi-worker deployments, depending on model size. Existing .bin and .ftz model files continue to work without modification. The ENABLE_FASTTEXT cmake option is removed; Fasttext support is now always compiled in. Packagers must remove the external libfasttext build dependency. Fuzzy hashes gain multiple flags A stored fuzzy hash previously carried a single flag. Version 4 allows a single digest to carry up to eight flags simultaneously, so multiple detection rules can match the same hash independently without duplicating the stored entry. The Redis update logic was rewritten in Lua with EVALSHA and NOSCRIPT recovery. The release also introduces an HTML_FUZZY_PHISHING symbol. It fires when an HTML template matches a known phishing template but the embedded domains differ, targeting phishing campaigns that reuse a template structure while swapping out links. The wire protocol moves to epoch 12 and remains backward-compatible. The highest-value flag occupies the primary slot. Ring Hash replaces Jump Hash Rspamd used Jump Hash for consistent upstream hashing in sharded Bayes deployments. Version 4 replaces it with Ring Hash (Ketama) with virtual nodes. Under Ring Hash, only roughly 1/n keys redistribute when an upstream fails, and keys return to their original upstream when it recovers. This change is a breaking one for operators running per-user Bayes on sharded Redis. After the upgrade, existing data lands on the wrong shards. The project requires operators to run rspamadm statistics_dump migrate before upgrading. Single-server deployments are not affected. HTTPS support added natively Workers can now serve HTTPS without a reverse proxy in front. SSL is auto-detected from bind socket configuration. The previous ssl = true worker option is removed; operators should remove it from configs and apply the ssl suffix to bind lines. Token bucket load balancing becomes the default Proxy upstream load balancing switches from simple round-robin to token bucket balancing by default. The algorithm accepts configurable max_tokens, scale, and base_cost parameters for burst traffic handling. Operators who want to restore round-robin can remove the token_bucket key from proxy upstream config. Jinja2 templating for configuration files Configuration files are now preprocessed by the Lupa Jinja2-compatible template engine before UCL parsing. Environment variables prefixed with RSPAMD_ are available inside templates as the env table. The templating system uses modified delimiters ({= =} for expressions, {% %} for control structures) to avoid conflicts with UCL syntax. Validation filters including mandatory, require_int, and require_json abort startup on invalid input, which the project intends to support container deployments that configure Rspamd through environment variables. Other additions and fixes Rspamd 4 adds native UUID v7 generation per scanning task, synchronized with the Log-Tag header and ClickHouse UUID v7 column support. The Bayesian classifier gains multiclass support, allowing classifiers to learn arbitrary categories beyond binary spam/ham. The WebUI learning interface is updated accordingly. Hyperscan compilation moves to an async Lua backend with Redis-based shared cache across workers and hosts. Multiple use-after-free conditions in Hyperscan cache handling during live configuration reload are resolved. SenderScore RBLs are disabled by default in this release. The project notes that the rules require a MyValidity account and were returning blocked results for all unregistered IPs. Operators with registered accounts must explicitly re-enable the rules. PDF parsing receives fixes for ASCII85 decoding, ligature substitution, and object padding evasion. DKIM unknown and broken key handling is updated to follow RFC behavior. A memory leak in the RSA path of DKIM signing is fixed, as is a SHA-1 DKIM signature crypto-policy bypass on RHEL/CentOS 10. A use-after-free in fuzzy UDP sessions and a CPU busy-loop in the fuzzy TCP client are also resolved in this release. Rspamd is available for free download on GitHub. Must read: 40 open-source tools redefining how security teams secure the stack Firmware scanning time, cost, and where teams run EMBA Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!

sqlmap: Open-source SQL injection and database takeover tool Finding and exploiting SQL injection vulnerabilities is one of the oldest and most common steps in web application testing. sqlmap streamlines this process. It is an open-source penetration testing tool that automates the detection and exploitation of SQL injection flaws and can take over database servers when configured to do so. What makes sqlmap valuable is its automation. Instead of manually crafting and testing payloads, the tool does the work of identifying injection points, determining the type of database in use, and running a range of exploitation techniques. For testers working across many targets, that speed and consistency make a difference. How sqlmap works sqlmap uses a detection engine that supports several types of SQL injection: boolean-based blind, time-based blind, error-based, UNION query-based, stacked queries, and out-of-band. Once it identifies a vulnerability, it can fingerprint the database, extract data, and even execute commands on the underlying operating system, depending on the level of access available. The tool can enumerate users, password hashes, roles, and privileges. It can identify database structures, search for particular tables or columns, and dump selected data ranges. Testers can focus on specific tables or strings, such as names or passwords, to locate sensitive credentials. Broad database support One of sqlmap’s strengths is its wide compatibility. It supports nearly every major database management system, including MySQL, Oracle, PostgreSQL, Microsoft SQL Server, Microsoft Access, IBM DB2, SQLite, Firebird, and SAP MaxDB. It also works with newer or niche platforms such as MariaDB, TiDB, CockroachDB, Vertica, OpenGauss, and ClickHouse. This range means testers can apply a single workflow across diverse environments. Whether the target is a traditional relational database or a distributed system, sqlmap can adapt its methods to match the DBMS in use. From database to operating system When sqlmap exploits an injection, it can often go beyond the database itself. If the target runs MySQL, PostgreSQL, or Microsoft SQL Server, the tool can access the file system directly. It allows users to upload or download files from the underlying operating system, a useful capability when testing post-exploitation scenarios. The same applies to command execution. sqlmap can run system commands and retrieve their output, offering testers a way to understand how deep their access goes. For advanced cases, it can open an out-of-band TCP connection between the testing machine and the target. Through this channel, users can spawn an interactive shell, a Meterpreter session, or even a VNC session for remote interaction. Integrating with other tools sqlmap also supports integration with Metasploit for privilege escalation. Using Metasploit’s Meterpreter getsystem command, a tester can attempt to elevate the database process’s privileges to gain higher-level access. This connection between tools highlights sqlmap’s flexibility within broader penetration testing workflows. For users who already have database credentials, sqlmap can connect directly without exploiting a vulnerability. This makes it useful not just for offensive testing but also for auditing and verifying database configurations. Testers can confirm which privileges exist and whether sensitive data is exposed. Why sqlmap remains a standard tool Despite the growth of automated scanners and cloud-based testing platforms, sqlmap remains a standard tool in many penetration testers’ toolkits. Its strength lies in combining automation with fine-grained control. Users can set switches to adjust behavior, control verbosity, or define exactly which data to extract. It supports both wide scanning and targeted analysis. A tester can run it across an entire application to locate vulnerable parameters, then narrow the focus to specific database tables or data ranges. The flexibility to shift between broad reconnaissance and precise exploitation is what keeps sqlmap relevant. sqlmap is available for free on GitHub. Must read: 35 open-source security tools to power your red team, SOC, and cloud security GitHub CISO on security strategy and collaborating with the open-source community Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!