These are the latest updates we've made to our platform. If you have any questions about any of the updates you see below, please feel free to contact us!
Website Scanner: There's another out-of-band detector available for insecure deserializations. This included passive detection for serialized objects and deserialization attacks for Java serialized objects.
Website Scanner: We've added an out-of-band detector for MySQL injections.
We added some caching to the Passive Scanner to avoid repeating some heavy computations. The overall scan duration can decrease by up to 25%, according to our testing.
The Website Scanner can now detect in-band file-inclusion vulnerabilities via XML External Entities and XInclude directives.
We've upgraded the Website Scanner with the ability to now detect prototype pollution in server-side javascript code.
We've added new exploitation capabilities to our Website Scanner that allow you to read the cookies and localStorage of a web app vulnerable to XSS.
Website Scanner: We've fixed some bugs: XSS and SQL scanner starting with auth enabled; SQLI time-based FPs; OSCMDI time-based FPs; CSRF token not renewing after the first form submission.
Website Scanner: We now search for locally available Docker and Elastic Search instances when trying to discover server-side request forgery vulnerabilities.
When starting a tool that scans URLs, you will have a new option: Follow redirects.
We've added new exploitation capabilities to our Website Scanner that allow you to read the cookies and localStorage of a web app vulnerable to XSS.
Our upgraded Website Scanner effortlessly identifies SPAs by harnessing browser-based spidering. Seamlessly explore websites by selecting the SPA option under Custom Scan -> Engine Options -> Spidering Approach. Moreover, when opting for the Deep Scan with SPA detection, our tool automatically enables browser-based spidering for a comprehensive scanning experience.
You can now detect server-side and client-side Request Smuggling vulnerabilities with our Website Scanner.
Website Scanner now extracts the database version after checking and finding SQL injection.
Website Scanner now includes HTTP requests and responses in the findings found with the Website Scanner.
We've added the Blind XSS injection type (to the current XSS detectors) you can now detect with our Website Scanner.
You can now check for XSS through template expressions in AngularJS and Vue apps using our Website Scanner.
We've added 'Group/Order By' payloads in our SQL Injection detector from Website Scanner so you can better detect these high-risk vulns.
We've added the option to include separated URLs in the Website Scanner to make sure there aren't any redirects and you are scanning the correct ones. You can add a list of your specific URLs and start scanning.
Some web apps support HTTP headers that can be used to override parts of the request URL. You can now detect them with our Website Scanner.
Website Scanner can now detect client-side prototype pollution. You can automatically detect sources for prototype pollution in the URL sent via web messages.
