These are the latest updates we've made to our platform. If you have any questions about any of the updates you see below, please feel free to contact us!
Website Scanner: We now search for locally available Docker and Elastic Search instances when trying to discover server-side request forgery vulnerabilities.
We've changed our Network Scanner to support 3 running modes (light, full, and custom) that allow you to scan targets with a predefined configuration.
We've changed our TCP/UDP Port Scanners to support 3 running modes (light, full, and custom) that allow you to scan targets with a predefined configuration.
When starting a tool that scans URLs, you will have a new option: Follow redirects.
Network Scanner can now detect if a Microsoft MSMQ service is vulnerable to a Remote Code Execution vulnerability (CVE-2023-21554).
Automatically detects and flags faulty scheduled scans that will surely hit a roadblock error such as VPN Error. Flagged scheduled scans will not be started. You can view the reason on the Scheduler Page.
Sniper can exploit an RCE vuln discovered in the Oracle Coherence product of Oracle Fusion Middleware (CVE-2020-2555).
You can now add in your Scans section an optional column where you can see which sub-user started a specific scan.
Creating a scan group when you start a scan on multiple targets will return a single aggregated report.
Sniper can exploit an RCE vuln discovered in Oracle Weblogic (CVE-2020-2883).
Sniper can exploit an RCE vuln discovered in Liferay Portal (CVE-2020-7961).
We've changed Sniper client-side attack, XSS Exploiter and HTTP Request Logger to be available per workspace. You can view all handlers created in the account using the 'Show handlers from all workspaces' button.
You can now search and filter for specific keywords on the Scans and the Assets page to easily identify a target or scan. Use single quotes or double quotes to achieve this.
We've added new exploitation capabilities to our Website Scanner that allow you to read the cookies and localStorage of a web app vulnerable to XSS.
If you are a heavy API user, you can now identify which scan a callback is from by using the included scan_id. You can find it in the header of a callback.
You now have the option to select which artefacts you want to extract from the target.
Take full control of your scanning experience by setting a custom scan time on your scans. Unlock the perfect balance between thorough coverage and accelerated results.
Sniper can exploit an Information Disclosure vulnerability in Minio (CVE-2023-28432).
The HTTP Lockpicker is a new Robot designed to crawl for web login interfaces and gain unauthorized access through them using a dictionary-based brute force attack.
The API Scanner is a powerful tool developed by our team to deeply analyze and optimize API endpoints for reliability, and security. Building on the success of our custom website vulnerability scanner, a comprehensive web application scanner, the API Scanner delivers precise vulnerability detection and actionable insights for your APIs. You can set custom headers that will be sent with each request to the server. E.g.: JWT tokens, authorization headers, etc.
