These are the latest updates we've made to our platform. If you have any questions about any of the updates you see below, please feel free to contact us!
We've implemented an auto-update mechanism system for our VPN Agents. Automatically download and install the newest versions of them. Zero downtime + no redeployment needed.
Sniper can exploit an RCE vuln found in the remote_agent.php file of the Cacti servers (CVE-2022-46169)
The Finding Templates page also got a fresh look and improved design. You can now search and filter for specific templates in a cleaner interface, and more.
Some web apps support HTTP headers that can be used to override parts of the request URL. You can now detect them with our Website Scanner.
Sniper can exploit a command injection vuln in the License Response Servlet (CVE-2023-0699)
Sniper can exploit an OS command injection vuln found in centOS Web Panel, that allows remote attackers to execute commands via shell metacharacters in the login parameter. (CVE-2022-44877)
For the client-side attack option, you can now choose between different types of macros that are added to the document (plain/obfuscated powershell).
Sniper can now exploit a RCE in multiple Zoho ManageEngine on-premise products. (CVE-2022-47966)
We've included a Status label for the findings of your scans in the HTMP and PDF reports.
When using our Network Scanner, Sniper, or Port Scanners, now you can choose the full port range (starting from 1 to 65535 ports) when scanning your targets.
The All scans page got a fresh redesign. You can now get a better view of your summary, better filtering for your tool names and start dates, expand and collapse all in the grouped view and more.
Sniper can now exploit a path traversal vuln located in the /public/plugins/endpoint of the Palo Alto servers. (CVE-2017-15944)
Sniper can now take a screenshot of the target system if it runs Windows. The picture will be available in your scan report and it's part of the Proof-of-Exploit.
Engagements page also got a fresh look and improved filtering. You can now hide the columns you don’t use to declutter the page and find the entries you want faster.
We added a new filter in our Pentest Robots for the website scanner block: Login Interface Found. This will match every new URL found by website scanner under the finding Login Interface Found. After this filter, you can add a Password Auditor so you can try to detect weak credentials.
Website Scanner can now detect client-side prototype pollution. You can automatically detect sources for prototype pollution in the URL sent via web messages.
Sniper can now exploit a Remote Code Execution vulnerability in the /password_change.cgi endpoint of the Webmin server. (CVE-2019-15107).
White Label page got a new look and feel, making it easier for you to perform changes. Now you can preview your custom logo, use tags to quickly change your Subject and more.
Website Scanner now has full HTTP requests and responses attachments in the evidence fields for all active detection modules like SQL Injection, XSS, SSRF and all the others. This part of the evidence can help you if you want to manually test the finding.
Sniper can now exploit a Remote Code Execution vulnerability in the web-based management interface of Cisco Small Business routers (CVE-2019-1653).
