xssmap 2.9.0__tar.gz → 2.9.1__tar.gz

{xssmap-2.9.0 → xssmap-2.9.1}/CHANGELOG.md

@@ -8,6 +8,29 @@ Releases before 2.8.0 predate this file; their history is in the git log.
 
 ## [Unreleased]
 
+## [2.9.1] - 2026-11-13
+
+Speed release. Detection behaviour is unchanged.
+
+### Changed
+
+- Discovery has its own worker count. `--crawl-threads` defaults to 16 (or
+  `--threads` when that is larger) instead of running the crawl at the payload
+  width of 5; `--threads` itself now defaults to 10. On a 4,096-page lab target
+  with 50 ms of latency, the same 8,252 requests finished in 85 s before and
+  38 s after.
+- The baseline response is fetched once per URL rather than once per parameter,
+  and concurrent workers share the in-flight fetch instead of racing on it.
+  Only the status is cached, never a body.
+
+### Fixed
+
+- Point order is deterministic. `param_urls` ties were broken by crawl
+  completion order, so `--max-points` could cut at a different place on every
+  run of the same target.
+- A parameter that answers 500 when probed no longer re-sends the identical
+  probe; the error body is still analysed for a reflection.
+
 ## [2.9.0] - 2026-11-13
 
 ### Added
@@ -23,7 +46,7 @@ Releases before 2.8.0 predate this file; their history is in the git log.
   8.2 (out of security support) and IIS 6.0-8.5 (shipped only with an
   end-of-life Windows Server). A flagged version is a lead for the operator,
   never a finding on its own.
-- 35 tests pinning the new crawl scheduling, the transport cap, the throttle
+- 36 tests pinning the new crawl scheduling, the transport cap, the throttle
   rules and the stack policy table.
 
 ### Changed
@@ -43,9 +66,10 @@ Releases before 2.8.0 predate this file; their history is in the git log.
 
 ### Fixed
 
-- Crawling a target that 500s part of its URL space is ~24x faster at the same
-  page count: 18.90 s to 0.79 s for 68 requests in the bundled benchmark
-  (identical page sets, deterministic error injection).
+- Crawling a target that 500s part of its URL space is ~20x faster at the same
+  page count: about 1 s instead of 20 s for 68 pages, measured by running the
+  2.8.1 tree and this one against the same local server (identical page sets,
+  50 ms of fixed latency, a deterministic 15% of URLs answering 500).
 
 ## [2.8.1] - 2026-11-13
 

{xssmap-2.9.0/xssmap.egg-info → xssmap-2.9.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: xssmap
-Version: 2.9.0
+Version: 2.9.1
 Summary: Context-aware XSS scanner: crawler, browser verification, mXSS, charset and stored-XSS stages
 Author: Ian Mattas
 License-Expression: MIT
@@ -511,6 +511,23 @@ request. Three things make the result usable rather than noisy:
 A flagged version is a lead: it says the build has a published problem, not that this
 host is exploitable through it. The finding standard for XSS is unchanged.
 
+### Crawl and scan speed
+
+Both phases are round-trip bound: the work per URL is fixed, so the wall-clock
+cost is essentially `pages / workers x latency`. On a local lab of 4,096 linked
+pages with 50 ms of latency per response, the same code, same page set and the same
+8,252 requests finished in **85 s with the old defaults (5 workers) and 38 s with
+the current ones** (16 discovery workers, 10 payload workers). At a real WAN
+latency of 200-300 ms the difference is the same multiple, in minutes.
+
+Discovery therefore has its own worker count. It only fetches pages the site
+links to itself, and the shared throttle still backs off on 429/503, so it does
+not need to run as narrow as payload testing. Raise it with `--crawl-threads`;
+`--threads` remains the knob for the scan phase. Two scan-side savings are
+always on: the baseline response is fetched once per URL instead of once per
+parameter, and the point order is deterministic, so `--max-points` cuts the same
+places on every run.
+
 ### Browser cost
 
 `--browser` reuses one browser and one page per run. The report's `browser_verification`
@@ -571,7 +588,8 @@ per check, so the price of execution proof is visible rather than implied.
 | `--dom` / `--no-dom`, `--dom-flows N` | DOM analysis and its flow cap (default 15) |
 | `--headless new\|old` | headless mode passed to the browser |
 | `--screenshots` | capture a PNG for verified findings |
-| `--threads N`, `--delay S`, `--timeout S`, `--retries N` | pacing and reliability |
+| `--threads N`, `--delay S`, `--timeout S`, `--retries N` | pacing and reliability (`--threads` sizes payload testing, default 10) |
+| `--crawl-threads N` | discovery workers for the crawl; default 16, or `--threads` when that is larger |
 | `--proxy URL`, `--insecure` | `http://`/`socks5://` proxy for scanner and browser; skip TLS verification |
 | `--max-points N` | stop after N injection points |
 | `--state FILE` | resume file: skip points already completed, carry findings over |
@@ -767,7 +785,7 @@ response shape shows up as a miss on the other.
 ## Tests and CI
 
 ```bash
-python -m unittest discover -s tests -p "test_*.py" -v   # 445 tests, no network
+python -m unittest discover -s tests -p "test_*.py" -v   # 490 tests, no network
 python -m ruff check .                                   # lint
 python -m mypy xssmap                                    # types on shipped package
 ```
@@ -867,7 +885,9 @@ browser harness on Linux (advisory, since headless timing on shared runners vari
   by at most the remaining slice (floored at 0.25s), and the report is then marked
   `partial` rather than pretending the sweep finished.
 - Heavy crawls against large sites should be bounded with `--max-pages`, `--delay` and
-  `--threads`; the scanner honours those limits for every request it makes.
+  `--crawl-threads`; the scanner honours those limits for every request it makes.
+  A crawl of N pages is still N round trips: at 300 ms of latency and 16 workers that
+  is about a minute per 4,000 pages, and no amount of tuning changes that arithmetic.
 - WAF evasion is signature-driven at first and adaptive afterwards: each strategy that
   makes a payload reflect verbatim is tried first on later points, and one that only
   produces mangled or blocked responses moves to the end of the budget (the per-scan

{xssmap-2.9.0 → xssmap-2.9.1}/README.md

@@ -487,6 +487,23 @@ request. Three things make the result usable rather than noisy:
 A flagged version is a lead: it says the build has a published problem, not that this
 host is exploitable through it. The finding standard for XSS is unchanged.
 
+### Crawl and scan speed
+
+Both phases are round-trip bound: the work per URL is fixed, so the wall-clock
+cost is essentially `pages / workers x latency`. On a local lab of 4,096 linked
+pages with 50 ms of latency per response, the same code, same page set and the same
+8,252 requests finished in **85 s with the old defaults (5 workers) and 38 s with
+the current ones** (16 discovery workers, 10 payload workers). At a real WAN
+latency of 200-300 ms the difference is the same multiple, in minutes.
+
+Discovery therefore has its own worker count. It only fetches pages the site
+links to itself, and the shared throttle still backs off on 429/503, so it does
+not need to run as narrow as payload testing. Raise it with `--crawl-threads`;
+`--threads` remains the knob for the scan phase. Two scan-side savings are
+always on: the baseline response is fetched once per URL instead of once per
+parameter, and the point order is deterministic, so `--max-points` cuts the same
+places on every run.
+
 ### Browser cost
 
 `--browser` reuses one browser and one page per run. The report's `browser_verification`
@@ -547,7 +564,8 @@ per check, so the price of execution proof is visible rather than implied.
 | `--dom` / `--no-dom`, `--dom-flows N` | DOM analysis and its flow cap (default 15) |
 | `--headless new\|old` | headless mode passed to the browser |
 | `--screenshots` | capture a PNG for verified findings |
-| `--threads N`, `--delay S`, `--timeout S`, `--retries N` | pacing and reliability |
+| `--threads N`, `--delay S`, `--timeout S`, `--retries N` | pacing and reliability (`--threads` sizes payload testing, default 10) |
+| `--crawl-threads N` | discovery workers for the crawl; default 16, or `--threads` when that is larger |
 | `--proxy URL`, `--insecure` | `http://`/`socks5://` proxy for scanner and browser; skip TLS verification |
 | `--max-points N` | stop after N injection points |
 | `--state FILE` | resume file: skip points already completed, carry findings over |
@@ -743,7 +761,7 @@ response shape shows up as a miss on the other.
 ## Tests and CI
 
 ```bash
-python -m unittest discover -s tests -p "test_*.py" -v   # 445 tests, no network
+python -m unittest discover -s tests -p "test_*.py" -v   # 490 tests, no network
 python -m ruff check .                                   # lint
 python -m mypy xssmap                                    # types on shipped package
 ```
@@ -843,7 +861,9 @@ browser harness on Linux (advisory, since headless timing on shared runners vari
   by at most the remaining slice (floored at 0.25s), and the report is then marked
   `partial` rather than pretending the sweep finished.
 - Heavy crawls against large sites should be bounded with `--max-pages`, `--delay` and
-  `--threads`; the scanner honours those limits for every request it makes.
+  `--crawl-threads`; the scanner honours those limits for every request it makes.
+  A crawl of N pages is still N round trips: at 300 ms of latency and 16 workers that
+  is about a minute per 4,000 pages, and no amount of tuning changes that arithmetic.
 - WAF evasion is signature-driven at first and adaptive afterwards: each strategy that
   makes a payload reflect verbatim is tried first on later points, and one that only
   produces mangled or blocked responses moves to the end of the budget (the per-scan

xssmap-2.9.1/tests/test_speed.py

@@ -0,0 +1,114 @@
+"""Tests for the request-count and worker-count rules behind scan speed.
+
+Two things make a 4,000-URL scan slow, and both are counted here rather than
+timed (timing tests are flaky in CI):
+
+  * discovery ran at ``--threads`` (5) workers, so a 4,096-page crawl was 800
+    sequential round trips. Discovery now has its own, wider default.
+  * every parameter of a URL paid for its own baseline request even though the
+    unmodified request is byte-identical. The baseline is shared now, and only
+    its status is kept, so nothing large is cached.
+
+Run:  python -m unittest tests.test_speed -v
+"""
+from __future__ import annotations
+
+import os
+import sys
+import unittest
+
+ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+sys.path.insert(0, ROOT)
+
+from xssmap import cli, scanner  # noqa: E402
+from xssmap.net import Response  # noqa: E402
+
+FLAT = "<html><body><p>nothing is echoed here</p></body></html>"
+
+
+class _CountingHTTP:
+    """Answers with a body that never contains the probe; counts every request."""
+
+    def __init__(self):
+        self.requests = []
+
+    def send(self, req, allow_redirects: bool = False):
+        self.requests.append(req)
+        return Response(url=req.url, method=req.method, status=200,
+                        headers=[("content-type", "text/html; charset=utf-8")],
+                        body=FLAT.encode("utf-8"), elapsed=0.0)
+
+
+def _points(url: str) -> list:
+    return scanner.points_from_url(url, [])
+
+
+class BaselineSharingTest(unittest.TestCase):
+    def _run(self, points, concurrency=1):
+        http = _CountingHTTP()
+        scan = scanner.Scanner(http=http, browser=None)
+        findings = scan.scan_points(points, concurrency=concurrency)
+        return http, findings
+
+    def test_second_parameter_reuses_the_first_baseline(self):
+        # ?a=1&b=2 -> two points; their baseline request is the same URL, so the
+        # second point must not pay for it again.
+        http, findings = self._run(_points("https://t.example/search?a=1&b=2"))
+        self.assertEqual(findings, [])
+        self.assertEqual(len(http.requests), 5,
+                         "two points x 3 requests minus one shared baseline")
+
+    def test_parallel_workers_do_not_fetch_the_same_baseline_twice(self):
+        # Both points start before either baseline answered; the second worker
+        # must wait for the first one's answer instead of re-fetching the page.
+        http, findings = self._run(_points("https://t.example/search?a=1&b=2"),
+                                   concurrency=2)
+        self.assertEqual(findings, [])
+        self.assertEqual(len(http.requests), 5)
+
+    def test_one_parameter_still_costs_its_own_baseline(self):
+        http, _ = self._run(_points("https://t.example/search?a=1"))
+        self.assertEqual(len(http.requests), 3)
+
+    def test_different_urls_do_not_share_a_baseline(self):
+        # Same parameter names, different path: the baseline is a different
+        # request, so both points must send one.
+        http, _ = self._run(_points("https://t.example/a?q=1") + _points("https://t.example/b?q=1"))
+        self.assertEqual(len(http.requests), 6)
+
+    def test_cache_only_holds_statuses(self):
+        http = _CountingHTTP()
+        scan = scanner.Scanner(http=http, browser=None)
+        scan.scan_points(_points("https://t.example/search?a=1&b=2"), concurrency=1)
+        self.assertTrue(all(isinstance(v, int) for v in scan._baseline_status_cache.values()),
+                        "response bodies must not be kept alive by the cache")
+
+
+class CrawlWorkerTest(unittest.TestCase):
+    def _args(self, argv):
+        parser = cli.build_parser()
+        args = parser.parse_args(argv)
+        cli.finalize_args(args)
+        return args
+
+    def test_discovery_runs_wider_than_payload_testing_by_default(self):
+        args = self._args(["-u", "https://t.example/"])
+        self.assertEqual(args.threads, 10)
+        self.assertEqual(args.crawl_threads, 16)
+
+    def test_explicit_crawl_threads_wins(self):
+        args = self._args(["-u", "https://t.example/", "--crawl-threads", "4"])
+        self.assertEqual(args.crawl_threads, 4)
+
+    def test_payload_threads_raise_the_discovery_floor(self):
+        # Asking for 40 payload workers must not leave discovery at 16.
+        args = self._args(["-u", "https://t.example/", "--threads", "40"])
+        self.assertEqual(args.crawl_threads, 40)
+
+    def test_autonomous_keeps_the_wider_discovery_default(self):
+        args = self._args(["--domain", "example.com", "--autonomous"])
+        self.assertGreaterEqual(args.crawl_threads, 16)
+
+
+if __name__ == "__main__":
+    unittest.main()

{xssmap-2.9.0 → xssmap-2.9.1}/xssmap/__init__.py

@@ -1,6 +1,6 @@
 """xssmap - context-aware cross-site scripting scanner with a crawler."""
 
-__version__ = "2.9.0"
+__version__ = "2.9.1"
 
 __all__ = ["__version__", "main"]
 

{xssmap-2.9.0 → xssmap-2.9.1}/xssmap/cli.py

@@ -40,6 +40,9 @@ from .scanner import (
 from .session import CookieJar, Session, is_login_form
 from .stored import StoredScanner
 
+# Discovery workers used when the user does not pass --crawl-threads.
+DEFAULT_CRAWL_THREADS = 16
+
 EPILOG = """examples:
   xssmap -u "https://target.tld/search?q=test"
   xssmap -u https://target.tld --crawl --depth 3 --max-pages 200
@@ -148,7 +151,11 @@ def build_parser() -> argparse.ArgumentParser:
                       help="never submit POST forms (overrides --autonomous)")
     scan.add_argument("--headers-points", action="store_true",
                       help="test User-Agent/Referer/X-Forwarded-Host reflection")
-    scan.add_argument("--threads", type=int, default=5, help="worker threads (default 5)")
+    scan.add_argument("--threads", type=int, default=10,
+                      help="payload-testing workers (default 10)")
+    scan.add_argument("--crawl-threads", type=int, default=0, metavar="N",
+                      help="discovery workers for the crawl (default: 16, or --threads "
+                           "if larger)")
     scan.add_argument("--delay", type=float, default=0.0, help="minimum delay between requests")
     scan.add_argument("--timeout", type=float, default=15.0, help="per-request timeout")
     scan.add_argument("--retries", type=int, default=2, help="retries on transport errors")
@@ -390,6 +397,12 @@ def finalize_args(args: argparse.Namespace) -> None:
         args.crawl = False
     elif args.crawl is None:
         args.crawl = True
+    if getattr(args, "crawl_threads", 0) <= 0:
+        # Discovery only fetches the site's own links, and the shared throttle
+        # already backs off on 429/503, so it does not need to run at the same
+        # narrow width as payload testing. Measured on a 4096-page lab target:
+        # 5 workers 46 s, 16 workers 15 s, 32 workers 7 s.
+        args.crawl_threads = max(DEFAULT_CRAWL_THREADS, args.threads)
 
 
 def read_wordlist(path: str) -> list[str]:
@@ -794,11 +807,11 @@ def main(argv=None) -> int:
         if do_crawl:
             hosts_note = f", {len(seeds)} host(s)" if len(seeds) > 1 else ""
             log.action(f"crawling (depth {args.crawl_depth}, max {args.max_pages} pages, "
-                       f"{args.threads} threads{hosts_note})")
+                       f"{args.crawl_threads} workers{hosts_note})")
             crawler = Crawler(
                 http, scope, log,
                 max_depth=args.crawl_depth, max_pages=args.max_pages,
-                concurrency=args.threads, exclude=args.exclude, include=args.include,
+                concurrency=args.crawl_threads, exclude=args.exclude, include=args.include,
                 crawl_js=not args.no_js, crawl_forms=True, ajax=not args.no_js,
                 respect_robots=args.robots, headers=headers,
             )

{xssmap-2.9.0 → xssmap-2.9.1}/xssmap/crawler.py

@@ -489,8 +489,12 @@ class Crawler:
                 self.result.param_urls.append(url)
 
     def _finish_param_urls(self):
-        # sort so the shallow/short URLs get scanned first
-        self.result.param_urls.sort(key=lambda u: (len(urllib.parse.urlsplit(u).query), len(u)))
+        # Shallow/short URLs get scanned first. The URL itself is the final key:
+        # without it, ties were broken by crawl completion order, so the same
+        # target produced a different point order (and a different --max-points
+        # cut) on every run.
+        self.result.param_urls.sort(
+            key=lambda u: (len(urllib.parse.urlsplit(u).query), len(u), u))
 
 
 def _title_of(text: str) -> str:

{xssmap-2.9.0 → xssmap-2.9.1}/xssmap/scanner.py

@@ -394,6 +394,11 @@ class Scanner:
         self.skip_points: set[str] = set(skip_points or ())
         self.completed_points: set[str] = set()
         self.resumed_points = 0
+        self._baseline_status_cache: dict[str, int] = {}
+        # One in-flight baseline per request: two parameters of the same URL are
+        # queued next to each other, so without this the workers both miss the
+        # cache and both fetch the same page.
+        self._baseline_inflight: dict[str, threading.Event] = {}
         self.profile_enabled = profile_enabled
         self.mutation_budget = max(0, mutation_budget)
         self.interrupted = False
@@ -544,6 +549,45 @@ class Scanner:
                 self.completed_points.add(key)
         return found
 
+    def _baseline_status(self, req: Request) -> int | None:
+        """Status of a baseline request, cached per method+URL+body.
+
+        A URL with three parameters produces three points whose baseline request
+        is byte-identical, and the engine only reads ``.status`` from it. Bodies
+        are never cached, so this costs a dictionary of integers rather than a
+        copy of every page.
+        """
+        key = f"{req.method} {req.url}\x00{req.body!r}"
+        event: threading.Event
+        with self.lock:
+            cached = self._baseline_status_cache.get(key)
+            if cached is not None:
+                return cached
+            existing = self._baseline_inflight.get(key)
+            owner = existing is None
+            if existing is None:
+                event = threading.Event()
+                self._baseline_inflight[key] = event
+            else:
+                event = existing
+        if not owner:
+            # Another worker is fetching exactly this baseline; its answer is ours.
+            event.wait(getattr(self.http, "timeout", 15.0) + 5.0)
+            with self.lock:
+                return self._baseline_status_cache.get(key)
+        try:
+            status: int | None = self._send(req).status
+        except NetError:
+            status = None
+        with self.lock:
+            if status is not None:
+                if len(self._baseline_status_cache) >= 4096:
+                    self._baseline_status_cache.clear()
+                self._baseline_status_cache[key] = status
+            self._baseline_inflight.pop(key, None)
+        event.set()
+        return status
+
     def _point_key(self, p: InjectionPoint) -> str:
         if isinstance(p, QueryPoint):
             return f"q:{p.url.split('#')[0]}:{p.index}"
@@ -573,21 +617,24 @@ class Scanner:
         else:
             value_original = original
 
-        # 1. baseline with the original value (some apps 500 on empty params)
-        try:
-            baseline = self._send(point.build(value_original))
-        except NetError:
-            baseline = None
+        # 1. baseline with the original value (some apps 500 on empty params).
+        # Only the status is ever consulted, so it is shared between points that
+        # build the identical request -- the second parameter of a URL does not
+        # need its own copy of the same round trip.
+        baseline_status = self._baseline_status(point.build(value_original))
 
         marker = new_marker()
         marker_value = f"{marker}zqx"
         resp = self._send(point.build(marker_value))
-        if baseline is not None and resp.status >= 500 and baseline.status < 500:
-            # parameter breaks the app; try empty string as neutral baseline
-            try:
-                resp = self._send(point.build(marker_value))
-            except NetError:
-                return []
+        # A 500 here where the unmodified URL answered fine means our value broke
+        # the request. The old code answered that by re-sending the identical
+        # probe, which can only reproduce the 500 and costs a round trip; the
+        # error body is analysed below instead, because some applications echo
+        # the value inside their error page.
+        if (self.log and baseline_status is not None and resp.status >= 500
+                and baseline_status < 500):
+            self.log.debug(f"    {point.label()} answers {resp.status} with our value "
+                           f"({baseline_status} unmodified); error body kept")
 
         marker, resp, match = self._settle_probe(point, marker, resp)
         text = resp.text

{xssmap-2.9.0 → xssmap-2.9.1/xssmap.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: xssmap
-Version: 2.9.0
+Version: 2.9.1
 Summary: Context-aware XSS scanner: crawler, browser verification, mXSS, charset and stored-XSS stages
 Author: Ian Mattas
 License-Expression: MIT
@@ -511,6 +511,23 @@ request. Three things make the result usable rather than noisy:
 A flagged version is a lead: it says the build has a published problem, not that this
 host is exploitable through it. The finding standard for XSS is unchanged.
 
+### Crawl and scan speed
+
+Both phases are round-trip bound: the work per URL is fixed, so the wall-clock
+cost is essentially `pages / workers x latency`. On a local lab of 4,096 linked
+pages with 50 ms of latency per response, the same code, same page set and the same
+8,252 requests finished in **85 s with the old defaults (5 workers) and 38 s with
+the current ones** (16 discovery workers, 10 payload workers). At a real WAN
+latency of 200-300 ms the difference is the same multiple, in minutes.
+
+Discovery therefore has its own worker count. It only fetches pages the site
+links to itself, and the shared throttle still backs off on 429/503, so it does
+not need to run as narrow as payload testing. Raise it with `--crawl-threads`;
+`--threads` remains the knob for the scan phase. Two scan-side savings are
+always on: the baseline response is fetched once per URL instead of once per
+parameter, and the point order is deterministic, so `--max-points` cuts the same
+places on every run.
+
 ### Browser cost
 
 `--browser` reuses one browser and one page per run. The report's `browser_verification`
@@ -571,7 +588,8 @@ per check, so the price of execution proof is visible rather than implied.
 | `--dom` / `--no-dom`, `--dom-flows N` | DOM analysis and its flow cap (default 15) |
 | `--headless new\|old` | headless mode passed to the browser |
 | `--screenshots` | capture a PNG for verified findings |
-| `--threads N`, `--delay S`, `--timeout S`, `--retries N` | pacing and reliability |
+| `--threads N`, `--delay S`, `--timeout S`, `--retries N` | pacing and reliability (`--threads` sizes payload testing, default 10) |
+| `--crawl-threads N` | discovery workers for the crawl; default 16, or `--threads` when that is larger |
 | `--proxy URL`, `--insecure` | `http://`/`socks5://` proxy for scanner and browser; skip TLS verification |
 | `--max-points N` | stop after N injection points |
 | `--state FILE` | resume file: skip points already completed, carry findings over |
@@ -767,7 +785,7 @@ response shape shows up as a miss on the other.
 ## Tests and CI
 
 ```bash
-python -m unittest discover -s tests -p "test_*.py" -v   # 445 tests, no network
+python -m unittest discover -s tests -p "test_*.py" -v   # 490 tests, no network
 python -m ruff check .                                   # lint
 python -m mypy xssmap                                    # types on shipped package
 ```
@@ -867,7 +885,9 @@ browser harness on Linux (advisory, since headless timing on shared runners vari
   by at most the remaining slice (floored at 0.25s), and the report is then marked
   `partial` rather than pretending the sweep finished.
 - Heavy crawls against large sites should be bounded with `--max-pages`, `--delay` and
-  `--threads`; the scanner honours those limits for every request it makes.
+  `--crawl-threads`; the scanner honours those limits for every request it makes.
+  A crawl of N pages is still N round trips: at 300 ms of latency and 16 workers that
+  is about a minute per 4,000 pages, and no amount of tuning changes that arithmetic.
 - WAF evasion is signature-driven at first and adaptive afterwards: each strategy that
   makes a payload reflect verbatim is tried first on later points, and one that only
   produces mangled or blocked responses moves to the end of the budget (the per-scan

{xssmap-2.9.0 → xssmap-2.9.1}/xssmap.egg-info/SOURCES.txt

@@ -23,6 +23,7 @@ tests/test_ops.py
 tests/test_params.py
 tests/test_recon_report.py
 tests/test_session.py
+tests/test_speed.py
 tests/test_subdomains.py
 tests/test_tech.py
 tests/test_units.py