Changelog

Our team also updated the Website Scanner's capabilities this past month so you have a more comprehensive view of your targets.

You can:

• detect insecure deserialization in PHP applications with the scanner’s Active module

• automatically detect GraphQL as we’ve integrated our API Vulnerability Scanner’s test methods for this language

We’ve also added more extensive findings to your scan results. 

The Website Scanner now:

• creates a new finding with all the API endpoints it detects during crawling

• fuzzes for Open API specifications, creates a new finding with any identified results, and even adds it into the Specification Spider

• adds exposures and exposed-panels Nuclei templates to the Interesting files finding so you detect even more publicly accessible pages that should’ve been hidden.

Plus, to make the overall scan results easier to navigate, we’re highlighting the request/response lines for all detectors, both passive and active.

There’s a new module in the active capabilities of our proprietary Website Scanner: detection for insecure deserialization in .Net applications.

To make XSS and SQLi findings easier to navigate, we’ve also added a highlight directly in the request/response line containing the payload used in that detection.

We've increased the URL crawling speed by 30%, making the Website Scanner more efficient from start to finish.

Our proprietary web app scanner now uses parallelization when detecting cloud hosted URLs. Expect faster discovery, quicker scan completion, and more timely results.

We’ve also improved the tool’s passive detection method with:

• Disclosure of OS paths in the HTTP response

• Detection for session tokens in the request URLs

Are you on the lookout for more efficiency in your workflows? (Who isn't, right?)

We've got a growing list of integrations so you run your security operations smoothly.

Just added:

• Discord - a popular request in our community! Get custom notifications for scan results, set different channels for specific alerts, and make sure everyone sees the relevant findings.

• Vanta - another popular request! Use it to automatically get PDF reports from scheduled scans only straight to your Vanta account and make compliance operations a bit smoother.

  

• You can now use the CLI version for our Website Vulnerability Scanner to set up vulnerability tests in your CI/CD flow.

Our colleague Mihai explains how to use it in this quick video:

Our Website Vulnerability Scanner also has new improvements:

• We've added an active detector for HTTP2 in the HTTP request smuggling.

• Get new findings when scanning and detecting the H2.TE (Transfer-Encoding) and H2.CL (Content-Length) vulnerabilities.

• File upload input detection now available in the passive scanner module.

Our well-loved Website Vulnerability Scanner also got updates, as it does every single month:

• SSTI code context - we've improved the capabilities of our Server Side Template Injection detector by adding payloads that work in code context.

• JWT phase 2 - And we've finished the second part of our JWT detector by adding payloads that work in code context. It can now detect: Weak HMAC Secrets and Algorithm Confusion issues.

We evaluated our Website Vulnerability Scanner with some of the most-known tools in Dynamic Web Application Security Testing, both commercial and open-source options: Burp Scanner, Acunetix, Qualys, Rapid7 InsightVM, and ZAP. Find out which was the most accurate scanner and which had the most false positives!

For a look behind the scenes, check out our blog article.

For all the data behind the results in the benchmark, download the white paper.

Our Website Vulnerability Scanner now has:

• Better spider results table - you now get a broader view of what the web spider did, including page title, page size, and status codes.

• More verbose vulnerability evidence - we've revamped some of the explanations around more complex detections so you get more details about the methods our scanner uses.

Our Website Vulnerability Scanner now:

• Detects flaws in JWT implementations by checking if web apps that use JWTs for authentication allow them to have a None or random signature, creating security risks

• Runs faster light web app scans that also come with detailed requests and responses for each finding

• Provides extra information about spidered responses in evidence which now includes the status code, page title, and page size for each URL

• Extracts proof of exploitation for Linux OS command injection in the form of hostnames and usernames.

Two new modules in the Website Vulnerability Scanner:

• Detection for misconfigured CSP Headers - identifies misconfigured content-security-policy headers on your website, enabling you to control resource loading and their allowed URLs.

• Enumerable Parameter Detector - explores possible enumerable parameters in your website. Some findings might reveal insecure direct object references after manual examination.

Our Website Vulnerability Scanner gets stronger with each monthly update!

We’ve integrated the fingerprinting capabilities from Nuclei into our proprietary tool - and it’s just the kickoff!

Soon, we’ll start incorporating many more templates. Until then, the 40+ vulnerability checks our Website Scanner runs can surely keep you - and your team - focused and making progress.

And one more thing: we added a method to detect if the Website Scanner spider finds an OpenAPI file. When it does, you can dig deeper with the API Scanner in just one click, right from your finding.

By the way, we love to see customers truly make the most of our tools:

We had a tool to scan our websites and endpoints automatically; the reports were not so good, and each additional URL was charged additionally (this doesn't scale in a micro-services architecture).

Pentest-Tools.com solved all our problems; you can scan up to 1000 targets, the reports are so professional, and you can choose from dozens of different tools to analyze all aspects of an enterprise architecture.

We've also introduced a new Session Fixation Detector to help you identify session hijacking risks. Using the mitigation recommendations will help you prevent unauthorized access to user sessions and sensitive data.

Here’s a preview of what the finding looks like:

We've implemented Input Reflected in DOM to enhance protection against XSS attacks, ensuring coverage of more vulnerabilities lying in the DOM. It is already implemented in the XSS detector so if you select the XSS detector you are covered.

Here’s what it’ll look like in your report:

We added the option to select automatic detection of the spidering approach that the target needs. Auto is the engine option used in the deep scans too.

We tweaked the spider results table from the Website Scanner so you can focus more on the things that matter the most: the url, the method, the query and body parameters. So, we removed the listing of headers and cookies and made the table more dynamic.

Website Scanner: Fixed a bug in our logout detection mechanism that caused the Spider to sign us out of the session while crawling.

Website Scanner: Fixed another bug in the logic driving the headless browser that crashed the page and prevented us from detecting new crawling targets.

Website Scanner now gives you a complete list of the URLs it spidered, including all the duplicates. Rest assured knowing the scanner thoroughly inspected all paths. You can see them by clicking the details of the Spidered URLs finding and checking the references.

Website Scanner: We've added a new detection mechanism for MongoDB injection based on generating errors in the response.