Changelog

• CVE-2024-24919 (CVSSv3 8.6) - can remote, unauthenticated attackers read the contents of any file on affected Check Point VPN servers, including password hashes for local accounts or SSH private keys?

• CVE-2022-31137 (CVSSv3 9.8) - can ransomware actors gain remote access to Roxy Wi, the server management GUI, using this vulnerability?

• CVE-2024-27198 (CVSSv3 9.8) - can attackers use this critical CVE to get RCE on your JetBrains TeamCity server?

These three custom exploitation modules our team added to Sniper will give you the answers - and proof! (The module for CVE-2024-24919 is coming in the next 48 hours).

Our Website Vulnerability Scanner now has:

• Better spider results table - you now get a broader view of what the web spider did, including page title, page size, and status codes.

• More verbose vulnerability evidence - we've revamped some of the explanations around more complex detections so you get more details about the methods our scanner uses.

We did two things to make light scans with the URL Fuzzer finish much quicker:

• changed the default wordlist

• included the ability to automatically add links and words from the HTML page source to the wordlist.

Your scheduled scans now sit next to your finished scans (in separate tabs, don't worry).

Moving scheduled scans from the Automation tab to Scans makes it easier to keep an eye on them and adjust them as your needs change.

Powerful and easy on the eyes - that's exactly what customers expect our tools to be. It's why we're systematically updating the look and feel of our results page for our entire range of tools.

In the past month, our DNS Server Scanner, Drupal Scanner, and SharePoint Scanner got their visual refresh. They're ready for you when you are!

We've introduced crucial detections for security issues that expand your attack surface:

• Publicly exposed VNC, MSSQL, and LDAP services - findings now flag if these services are publicly accessible on the Internet, so you can tighten your network's security posture

• CVE-2023-3824 (CVSSv3 9.8) - stack buffer overflow in PHP that leads to RCE

• CVE-2023-44487 (CVSSv3 7.5) - we enhanced detection accuracy for HTTP/2 Rapid Reset by checking if the target supports the HTTP/2 protocol and the HTTP/2 RST_STREAM directive

• Comprehensive DNS records - see a new finding when a target has DNS records available (A, AAAA, MX, NS, SOA, TXT, SPF, CAA, CNAME) and get deeper visibility into the target’s domain structure.

Sniper just got sharper with new exploits for two critical CVEs:

• CVE-2024-0204 (CVSSv3 9.8) - assess the business risk of the Authentication Bypass vulnerability in GoAnywhere MFT, which leads to RCE by uploading a webshell

• CVE-2024-1212 (CVSSv3 10) - validate the threat of exploiting this Remote Code Execution vulnerability in Progress Kemp LoadMaster

Our Website Vulnerability Scanner now:

• Detects flaws in JWT implementations by checking if web apps that use JWTs for authentication allow them to have a None or random signature, creating security risks

• Runs faster light web app scans that also come with detailed requests and responses for each finding

• Provides extra information about spidered responses in evidence which now includes the status code, page title, and page size for each URL

• Extracts proof of exploitation for Linux OS command injection in the form of hostnames and usernames.

The Subdomain Finder now uses external APIs tests in light scans to return subdomains faster by accessing online databases. We also increased the list of external APIs so it extracts more subdomains for your targets.

3 improvements you’ll notice as you log into your account:

• Single sign-on with Microsoft - jump straight into action using your existing Microsoft account

• View all assets across workspaces - easily search for, identify, and manage duplicate assets from all your workspaces at once.

• Unified notifications across integrations: you can now get the same notification through multiple services, in preparation for even more integration options we’ll launch in the future.

Want to put a face to these updates?

Our fresh new Teams page is a great way to see who’s behind this email and the entire Pentest-Tools.com toolkit.

We upgraded the reporting limit for Light scans by 10x! The Subdomain Finder now provides up to 1000 entries and includes unresolved results so older subdomains are available.

Thanks to our security research team, you can now detect:

• CVE-2024-23897 (CVSSv3 7.5) - Unauthenticated Arbitrary File Read in Jenkins

• CVE-2023-41056 (CVSSv3 8.1) - Remote Code Execution in Redis

• CVE-2023-5631 (CVSSv3 5.4) - Cross-Site Scripting in Roundcube

Speaking about Roundcube, a couple of months ago we published an analysis - and public exploit - for CVE-2021-44026, an SQL injection vulnerability in the open-source mail client.

The Network Scanner now also generates explicit findings for sensitive services that shouldn't be exposed on the internet (e.g. SMB, RDP, MySQL), which are easier to include in your reports.

The Scan with Tool button has a fresh look and a new location. It's now called New Scan and you’ll find it at the very top of the sidebar. We are working to make your scanning experience even better in the future!

This is something we promise you’ll always see in our new status page. 🤞The page includes statuses for our public website, the blog, the platform, the API, and more!

We streamlined the look and feel of the Scan results section, keeping it as valuable as ever. We’re rolling out more visual updates for all our tools in the coming months, so stay tuned!

As some of our customers requested, we enhanced the evidence section of findings that the Nuclei engine generates. Now, you’ll receive more relevant details about how the engine produced a finding.

See what happens when The XSS Rat combines his methods with our toolkit and features.

PS: Sniper Auto-Exploiter gets a lot of love - and for good reason!

People Hunter identifies the people associated with the target, using publicly available information from web server responses.

Details such as email addresses (and their patterns) and social media profiles help you identify potential targets for social engineering attacks.