Detect CORS misconfiguration in Website Scanner
Copy link to “Detect CORS misconfiguration in Website Scanner”We added to Website Scanner the capability to detect dangerous Cross-Origin Resource Sharing (CORS) configurations.
Changelog
These are the latest updates we've made to our platform. If you have any questions about any of the updates you see below, please feel free to contact us!
Date
February 2022
SSTI detection in Website Scanner
Copy link to “SSTI detection in Website Scanner”We added to Website Scanner the capability to detect Server-Side Template Injection.
January 2022
Exploit for CVE-2018-11776 (RCE in Apache Struts)
Copy link to “Exploit for CVE-2018-11776 (RCE in Apache Struts)”Sniper can now exploit an RCE in Apache Struts (CVE-2018-11776).
Exploit for CVE-2020-14883 (RCE in Oracle Weblogic)
Copy link to “Exploit for CVE-2020-14883 (RCE in Oracle Weblogic)”Sniper can now exploit an RCE in the Oracle Weblogic server (CVE-2020-14883).
New notification triggers
Copy link to “New notification triggers”We added new notification triggers related to the status of a scan: Stopped by user, VPN Error, Auth Error, Conn Error, Aborted.
Send notifications to other emails
Copy link to “Send notifications to other emails”You can now send a notification to additional emails.
Webhooks
Copy link to “Webhooks”We added Webhooks so you can trigger outgoing HTTP POST requests from Pentest-Tools.com to your endpoints whenever certain events have happened
Detection for CVE-2021-44228 (Log4shell in MobileIron)
Copy link to “Detection for CVE-2021-44228 (Log4shell in MobileIron)”The Network Scanner can now detect if a MobileIron Core server instance is vulnerable to Log4Shell (CVE-2021-44228).
Exploit for CVE-2018-2894 (RCE in Oracle Weblogic)
Copy link to “Exploit for CVE-2018-2894 (RCE in Oracle Weblogic)”Sniper can now exploit an RCE in the Oracle Weblogic server (CVE-2018-2894).
Exploit for CVE-2021-40539 (RCE in Zoho ManageEngine)
Copy link to “Exploit for CVE-2021-40539 (RCE in Zoho ManageEngine)”Sniper can now exploit an RCE in the Zoho ManageEngine ADSelfService Plus (CVE-2021-40539).
Detection for CVE-2021-44228 (Log4shell in Elasticsearch)
Copy link to “Detection for CVE-2021-44228 (Log4shell in Elasticsearch)”The Network Scanner can now detect if an Elasticsearch server is vulnerable to Log4Shell (CVE-2021-44228).
Detection for CVE-2021-44228 (Log4shell - RCE in VMware vCenter)
Copy link to “Detection for CVE-2021-44228 (Log4shell - RCE in VMware vCenter)”The Network Scanner can now detect if a VMware vCenter instance is vulnerable to Log4Shell (CVE-2021-44228).
Exploit for CVE-2019-17571 (RCE in Log4j)
Copy link to “Exploit for CVE-2019-17571 (RCE in Log4j)”Sniper can now exploit an RCE in the Log4j logging library (CVE-2019-17571).
Message brokers in Password Auditor
Copy link to “Message brokers in Password Auditor”The Password Auditor can now discover weak credentials over the following protocols: MQTT, AMQP, STOMP.
Detection for CVE-2021-40438 (SSRF in Apache server)
Copy link to “Detection for CVE-2021-40438 (SSRF in Apache server)”The Network Scanner can now detect if an Apache HTTP Server is vulnerable to Server Side Request Forgery (SSRF) (CVE-2021-40438).
Exploit for CVE-2021-43798 (Path Traversal in Grafana)
Copy link to “Exploit for CVE-2021-43798 (Path Traversal in Grafana)”Sniper can now exploit a Path Traversal vulnerability in Grafana (CVE-2021-43798).
Detection for CVE-2021-44228 (Log4shell in Apache Druid)
Copy link to “Detection for CVE-2021-44228 (Log4shell in Apache Druid)”The Network Scanner can now detect if an Apache Druid instance is vulnerable to Log4Shell (CVE-2021-44228).
Detection for CVE-2021-44228 (Log4shell in Apache Flink)
Copy link to “Detection for CVE-2021-44228 (Log4shell in Apache Flink)”The Network Scanner can now detect if an Apache Flink instance is vulnerable to Log4Shell (CVE-2021-44228).
Detection for CVE-2021-44228 (Log4shell in Apache Solr)
Copy link to “Detection for CVE-2021-44228 (Log4shell in Apache Solr)”The Network Scanner can now detect if an Apache Solr instance is vulnerable to Log4Shell (CVE-2021-44228).