Get a demo
AppSec with Zero Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo

Invicti Standard 28 Jan 2021

NEW FEATURES

  • Added NIST SP 800-53 compliance classification and report template.
  • Added DISA STIG compliance classification and report template.
  • Added the OWASP ASVS 4.0 classification and report template.
  • Added header and footer section to customize reports.
  • Added an option to customize POST attacks for the Open Redirect engine.

NEW SECURITY CHECKS

  • Added PHP magic_quotes_gpc Is Disabled security check.
  • Added PHP register_globals Is Enabled security check.
  • Added PHP display_errors Is Enabled security check.
  • Added PHP allow_url_fopen Is Enabled security check.
  • Added PHP allow_url_include Is Enabled security check.
  • Added PHP session.use_trans_sid Is Enabled security check.
  • Added PHP open_basedir Is Not Configured security check.
  • Added PHP enable_dl Is Enabled security check.
  • Added ASP.NET Tracing Is Enabled security check.
  • Added ASP.NET Cookieless Session State Is Enabled security check.
  • Added ASP.NET Cookieless Authentication Is Enabled security check.
  • Added ASP.NET Failure To Require SSL For Authentication Cookies security check.
  • Added ASP.NET Login Credentials Stored In Plain Text security check.
  • Added ASP.NET ValidateRequest Is Globally Disabled security check.
  • Added ASP.NET ViewStateUserKey Is Not Set security check.
  • Added ASP.NET CustomErrors Is Disabled security check.
  • Added PHP session.use_only_cookies Is Disabled security check.
  • Added new Blind SQL Injection attack pattern.
  • Added Jinjava SSTI security check.
  • Added Whoops Framework Detected security check.
  • Added CrushFTP server detected security check.
  • Added database error message signature pattern for Hibernate.
  • Added Identified, Version Disclosure, and Out-of-date security checks for W3 Total Cache.
  • Added Identified, Version Disclosure, and Out-of-date security checks for Next.JS React Framework.
  • Added Identified, Version Disclosure, and Out-of-date security checks for Twisted Web HTTP Server.
  • Added Identified, Version Disclosure, and Out-of-date security checks for Werkzeug Python WSGI Library.
  • Added Identified, Version Disclosure, and Out-of-date security checks for OpenResty.
  • Added Identified, Version Disclosure, and Out-of-date security checks for GlassFish.
  • Added Identified, Version Disclosure, and Out-of-date security checks for Resin Application Server.
  • Added Identified, Version Disclosure, and Out-of-date security checks for Plone CMS.
  • Added Identified, Version Disclosure, and Out-of-date security checks for Trac Software Project Management Tool.
  • Added Identified, Version Disclosure, and Out-of-date security checks for IBM RTC.
  • Added Identified, Version Disclosure, and Out-of-date security checks for Tornado Web Server.
  • Added Identified, Version Disclosure, and Out-of-date security checks for Jetty Web Server.
  • Added Identified, Version Disclosure, and Out-of-date security checks for Axway SecureTransport Server.
  • Added Identified, Version Disclosure, and Out-of-date security checks for Artifactory.
  • Added Identified, Version Disclosure, and Out-of-date security checks for Gunicorn Python WSGI HTTP Server.
  • Added Identified, Version Disclosure, and Out-of-date security checks for IBM Security Access Manager (WebSEAL).
  • Added Identified, Version Disclosure, and Out-of-date security checks for Nexus OSS.
  • Added Identified, Version Disclosure, and Out-of-date security checks for Cowboy HTTP Server.
  • Added Identified, Version Disclosure, and Out-of-date security checks for Python WSGIserver.
  • Added Identified, Version Disclosure, and Out-of-date security checks for Restlet Framework.
  • Added Identified, Version Disclosure, and Out-of-date security checks for Phusion Passenger.
  • Added Version Disclosure and Out-of-date security checks for Liferay Portal.
  • Added Version Disclosure and Out-of-date security checks for Tracy debugging tool.
  • Added detection for Varnish HTTP Cache Server.
  • Added detection for SonicWall VPN.
  • Added detection for Play Web Framework.
  • Added detection for Private Burp Collaborator Server.
  • Added detection for LiteSpeed Web Server.
  • Added detection for JBoss Enterprise Application Platform.
  • Added detection for JBoss Core Services.
  • Added detection for WildFly Application Server.
  • Added detection for Oracle HTTP Server.
  • Added version disclosure Daiquiri security check.

IMPROVEMENTS

  • Added Wordlist Entries feature to the Resource Finder security check group
  • Added CVSS3.0 and CVSS3.1 scoring for HSTS Policy Not Enabled.
  • Improved Open Redirect attack patterns.
  • Improved TLS 1.0 issue remediation reference.
  • Added WCF service support to WSDL importer.
  • Added a fix to reduce the possibility of an out-of-memory problem.
  • Added authentication support to system proxy for PAC file.
  • Verification dialog remembers old logout keywords.
  • Added scan profile information and URL to all reports.
  • Added bypass list for scan policy settings.
  • Added scan scope variables to the Pre-Request Scripts.
  • Added information label to the Pre-Request Script settings panel
  • Added a fail tolerance to Puppeteer launch.
  • Improved Tomcat signature patterns.
  • Improved authenticator not to store the plain password in the request data
  • Added HTTP Request Logger to authentication
  • Added Canada region to the Invicti Enterprise settings
  • Added tooltip to the Excluded Usage Trackers feature.
  • Removed X-Scanner header from default scan policies
  • Added new sensitive comment patterns.
  • Revised the description of the Resource Finder checks option.
  • Removed header and footer settings for reports that do not contain header and footer in the save report dialog.
  • Added Incremental Scan to Knowledge Base reports.
  • Updated Invicti Standard splash screen.

FIXES

  • Fixed Lodash Identified security check signature.
  • Fixed WebLogic Version Disclosure security check signature.
  • Fixed Whoops Error Handling Framework Identified security check signature.
  • Fixed Zope Web Server Version Disclosure security check signature.
  • Fixed Grafana Version Disclosure security check signature.
  • Fixed ASP.NET MVC Version Disclosure security check signature.
  • Fixed Telerik Version Disclosure vulnerability severity to be low.
  • Fixed IIS Version Disclosure vulnerability severity to be low.
  • Fixed the grammar issues at the CSP Not Implemented report template.
  • Hide the scope tooltip at the manual authentication panel.
  • Fixed the order of Out-of-Date vulnerabilities; now sorting vulnerabilities by their severities.
  • Fixed the issue “link stuck error” was repeated many times in the scan logs.
  • Fixed the typo in the Pre-Request Scripts Menu.
  • Fixed a few typos in the Impact descriptions.
  • Fixed validating WAF settings before trying to test WAF connection
  • Fixed the issue where the Exclude Authentication Pages option could not be manually disabled when the Form Authentication is enabled.
  • Fixed an issue where the Form Authentication verification dialog loses focus and disappears.
  • Fixed directory modifiers limit usage
  • Fixed sending previous request headers while navigating to the Form Authentication’s latest response URL.
  • Fixed an issue where the custom script dialog failed to display login page when requests encoded with Brotli
  • Fixed an issue that causes Reflected Parameter analyzer attacks to the ignored parameters when the breach engine is disabled
  • Fixed an issue that may cause the null reference exception when reflected parameter analyzer working
  • Fixed an issue that caused WASC ID is not sent properly in the Kenna Send To Action
  • Fixed an issue where the HTTP request is not redirected to HTTPS when Strict Transport Security is enabled
  • Fixed an issue that caused DOM simulation to fail because of the null windows and elements
  • Fixed an issue that is caused by NTLM, Kerberos, Negotiate authentication credentials send with every request without challenge
  • Fixed an issue that causes the Pre-Request Script requests to be ignored when its method is disallowed from the Scope settings
  • Fixed an issue that causes raw request created without cookies
  • Added SSL, Attack Possibility, and JavaScript files to Knowledge Base
  • Fixed the order of classification report ribbon menu.
  • Fixed handling the invalid characters of request headers set from the Pre-Request Scripts.
  • Fixed the tooltip of Send To Tasks button at the ribbon
  • Fixed unwanted warning on the auto authenticator
  • Fixed date and time zone problem on Swagger file.
  • Fixed null reference exception on excluded URL check.
  • Fixed multiple instance knowledge base render problem.
  • Fixed reporting style issues.
  • Fixed relativity of the charts in the Comparison Report.
  • Fixed grid showing on the logout detection screen.
  • Fixed scan resuming problem on unavailable host.
  • Fixed pop-up problem on the DOM simulation for better performance.
  • Fixed the logo at the Knowledge Base render error page.
  • Fixed an issue which causes unhandled exception when the link clicked multiple times on authentication verify dialog when interactive login is enabled
  • Fixed internet connection problem at test site configuration dialog.
  • Added information label to the Azure Configuration wizard.
  • Fixed request and response results in out-of-band vulnerabilities.
  • Fixed Blind SQL Injection cache issue.
  • Fixed wrong expiry time for cookie which occurs at DOM simulation.
  • Fixed the null reference exception while checking the source type.
  • Fixed the Basic Authentication header problem for chromium requests.
  • Fixed the null reference exception while getting authorization tokens.
  • Fixed an issue where XSLT requests are not intercepted.
  • Fixed Netsparker Helper Service dll not found issue.
  • Fixed the client certificate selection issue while logging in to the target website.
  • Fixed session storage problem at DOM simulation.
  • Fixed upload request problem that creates false positive at LFI engine.
  • Fixed chromium errors at authentication
  • Fixed the unhandled multiple choices redirect status code at requester.
  • Fixed the keyword-based logout detection stuck when the pop-up opened at chromium browsers.
  • Fixed the Generate Exploit button label in the ribbon menu and vulnerability pop-up menu.
  • Fixed an issue where the form value parser was not working.
  • Fixed unauthorized request handling in the license view.
  • Fixed an issue that causes invalid parent issue selection if Check Inverse is used at Security Checks
  • Fixed maximum logout detection issue.
  • Fixed the typo in the Pre-request Scripts menu.
  • Fixed a few typos in the Impact descriptions.
  • Fixed the issue that email disclosure was reported without identified email addresses.
  • Fixed an issue in the scan policy optimizer where the DOM preset was set wrong.
  • Removed URL signature field from the phpinfo detection pattern.
  • Fixed Perl version disclosure pattern.
  • Fixed the issue that movable type cannot be detected because the app name contained whitespace.
  • Removed the Fiddler core dependency from Fiddler Importer that caused issues in Linux agents.
  • Fixed the custom script dialog title.
  • Fixed the signature of Python version disclosure pattern.
  • Fixed the issue that charset error was repeated many times in the logs.
  • Fixed the issue that the attack parameter name was not displayed on error based SQL injection vulnerabilities.
  • Fixed an ArgumentNullException that was thrown when the proxy bypass list is null.
  • Fixed the request parsing error in TCP Requester.
  • Fixed the issue that header and footer were mixed up in the reports.
  • Fixed info icons position in the Knowledge Base reports.
  • Fixed the issue XSS payload was not highlighted correctly.
  • Fixed the typo in the base scan CLI argument.
  • Fixed the issue that the confirmation dialog was not displayed when the delete rows button in the context menu is used.
  • Fixed the inconsistencies in the summary page of Asana configuration wizard.
  • Fixed tooltip enabled/disabled states in Form Authentication, Client Certificate, and Smart Card Authentication settings.
  • Fixed the issue that search results were not highlighted correctly.
  • Fixed the issue that URL was not correctly encoded in Send To Action templates.
  • Fixed the issue request.Headers was empty in custom script API.
  • Fixed the issue Mithril version could not be detected.
  • Fixed the issue that SSTI could not be detected consistently because the code execution patterns were not loaded correctly.
  • Fixed the issue that version disclosure vulnerabilities were always fixed in retest.
  • Fixed the issue that causes FP Open Redirection because of the improper decoding of location header
  • Fixed Swagger parser that caused importing object with a parent node while the object is inside an array