Get a demo
AppSec with Zero Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo

Invicti Standard 07 Apr 2021 v6.0.2.30446

NEW FEATURES

  • Added TLS 1.3 support
  • Added the character limit setting for Blind SQL Injection proof generation and enabled proof generation by default
  • Added the Common Vulnerability Scoring System field to the known vulnerabilities
  • Added the Vulnerability Database version to the scan logs

IMPROVEMENTS

  • Improved IPv6 support to cover all SSL checks
  • Added an advanced setting option to turn on/off the “disable-web-security” command line option while launching chromium
  • Added the redirect navigation support for DOM Parser
  • Fixed Ghost Chromium problems and DOM simulation leaks
  • Added multiple ISO Classification support
  • Added alphabetical order to the Knowledge Base nodes
  • Updated Invicti Shark (IAST) licensing
  • Improved WAF Identification checks to prevent false positives
  • Added CVSS3.0 and CVSS3.1 scoring for HSTS Policy Not Enabled
  • Improved Open Redirection checks
  • Updated Capture Group for OpenResty Version Disclosure
  • Updated DS_Store File Found Report Template
  • Changed the Referrer-Policy Report Template names to be more accurate
  • Refined Possible Stored XSS Vulnerability template
  • Added missing external references to SSL Templates that are removed after the merge
  • Added IAST suffix to titles of vulnerability detected by Invicti Shark
  • Updated OpenSSL regex
  • Updated OpenSSL version disclosure regex
  • Updated SSTI patterns to use specific type to match code execution patterns

NEW SECURITY CHECKS

  • Added Short XSS Attack to bypass character limit checks
  • Added Revoked SSL Certificate check
  • Added SSL Certificate’s Name and Hostname Mismatch security check
  • Added SSL Certificate is not signed by a trusted root certification authority security check
  • Added Daiquiri Identified security check
  • Added Expired SSL Certificate security check
  • Added ZSH History File Detected
  • Added DOM XSS pattern for the script SRC Injection

FIXES

  • Fixed an issue with simultaneous access to the same object while updating the sitemap during scanning
  • Fixed unexpected error when saving parse from URL in form values screen
  • Fixed the Chrome address bar displaying in different resolutions on the verify login form
  • Fixed the detected logout status when an unreachable link is given
  • Fixed the customization menu at the form authentication’s custom script dialog
  • Fixed unsupported browser issue for Headless Chromium
  • Fixed weak ciphers not reported for additional websites issue
  • Fixed ignoring weak ciphers check because of the ROBOT attack
  • Fixed logging HTTPS requests as HTTP when LogHttpRequests option is enabled
  • Updated Invicti Updater icons
  • Fixed an issue where the Postman Importer ignores the authorization header that is defined in a request item
  • Updated requester not to send Accept-Language header if it is not enabled in a scan policy
  • Fixed an issue that occurred when exporting custom reports generated from Compliance, Detailed Scan, and Executive Summary report
  • Fixed a synchronization problem while creating puppeteer instances
  • Fixed an issue where external schema was not added when importing WSDL
  • Fixed the Write Lock Leak in LinkPool
  • Disabled mouse wheel on the Include/Exclude URLs with Regex radio group
  • Fixed the typo in the jQuery validation out-of-date vulnerability type
  • Fixed the issue Untrusted Root certificate was not reported on the self-signed certificates
  • Fixed the issue that the wrong version was reported in the web app fingerprinting
  • Fixed False Positive weak credentials vulnerability
  • Fixed the issue that logs were not correctly formatted in the Logs panel
  • Fixed the issue that SSL vulnerabilities found in additional sites might be reported in the wrong URL
  • Fixed the issue that authenticated link was not crawled
  • Fixed the issue that the proof URL was not added to XSS
  • Fixed word-wrapping in Tags label in the Azure DevOps Send to Action Configuration Wizard
  • Removed the logging for the replacing control characters in headers
  • Changed the log level of DOM simulation timeout from Error to Warning
  • Fixed the issue that another hash was appended to URLs with a fragment on DOM XSS attacks
  • Fixed the issue that SSL certificates were not analyzed for each website when there are additional websites
  • Fixed the issue that URI fragment was parsed incorrectly
  • Fixed OpenSSL version disclosure regex
  • Fixed WS_FTP Log check
  • Fixed F5 BIG-IP WAF detection
  • Fixed the typo in the jQuery Validation Out-of-date Vulnerability type
  • Fixed Extractor for Lodash in repository.json by adding a new function
  • Fixed WildFly regex for the WildFly Application Server Identified
  • Fixed Whoops Error Handling framework signature
  • Fixed the signature for Liferay Portal Identified
  • Fixed Version Disclosure for Artifactory by adding missing custom field tag
  • Fixed regex of Grafana Version Disclosure
  • Fixed OpenResty regex for Version Disclosure
  • Fixed the regex of Liferay Portal Version Disclosure pattern