These are the latest updates we've made to our platform. If you have any questions about any of the updates you see below, please feel free to contact us!
Website Scanner now has full HTTP requests and responses attachments in the evidence fields for all active detection modules like SQL Injection, XSS, SSRF and all the others. This part of the evidence can help you if you want to manually test the finding.
Overwrite the default maximum time that the Website Scanner is allowed to run (24h). The minimum is 30 minutes if you want to get faster results.
Website Scanner is now greatly improved (up to 60%) by parallelising the active detectors.
Website Scanner findings that haven't been automatically validated by our scanner and need further manual verification will be marked with the 'Unconfirmed' tag.
We added to Website Scanner the capability to detect dangerous Cross-Origin Resource Sharing (CORS) configurations.
We added to Website Scanner the capability to detect Server-Side Template Injection.
The Website Scanner can now detect the Apache Log4j vulnerability (CVE-2021-44228).
We added detection for Ruby Code injection in The Deep Website Scanner.
Added detection for Broken Authentication while running an authenticated website scan in the Website Scanner.
We added detection for Perl Code injection in The Deep Website Scanner.
We added detection for Python Code injection in The Deep Website Scanner.
We added detection for PHP Code Injection in the Deep Website Scanner.
The Deep Website Scanner will now generate more screenshots to simplify the reporting flow.
Website Scanner findings that have been automatically validated by our scanner will be marked with the Confirmed tag.
Now you can limit the maximum requests (per second) for the Website Scanner. Check the Engine Options → Limits → Requests per second.
The New Website Scanner will provide at the end of a scan result some stats: URLs spidered, the total number of HTTP requests, error count, etc.
The Website Scanner findings will now be classified by OWASP 2013, OWASP2017 and CWE. Check the Details of a finding to see more.
Our new Website Scanner (currently in beta) will now check for sensitive data (email addresses, social security numbers, credit card numbers) in target applications.
We launched a new Website Scanner (currently in beta) fully written by our team. It allows you to select which tests you want to run and it returns less False Positives than the current deep scanner.
