Invicti Standard

FIXES

• Fixed an InvalidCastException occurs on DOM Parser on some configurations

• Fixed some incorrect UI control sizes and locations

Read the blog post for more details about this version

NEW FEATURES

• Added classifications for PCI DSS Version 3.0 to vulnerability details

• Added new PCI Version 3.0 report template

BUG FIX

• Fixed an issue on Configure Form Authentication wizard where token, custom header and proxy settings weren’t used from selected scan policy

Read the blog post for more details about this version

NEW WEB SECURITY TESTS

• Added attack patterns for LFI vulnerability which is revealed with only backslashes in file path

• Added Programming Error Message vulnerability detection for SOAP faults

• Added AutoComplete vulnerability for password inputs

• NuSOAP version disclosure

• NuSOAP version check

NEW FEATURES

• SOAP Web Services scanning – ability to scan SOAP web services for security issues and vulnerabilities

• Request and Response viewers to view HTTP requests/responses like XML and JSON tree views

• New knowledge base node that will include all AJAX/XML HTTP Requests

• New value matching options for form values other than regex pattern (exact, contains, starts, ends)

• New report template for parsing source information Crawled URLs List (CSV)

IMPROVEMENTS

• Improved XSS vulnerability confirmation

• Improved Generic Source Code Disclosure security check by excluding JavaScript and CSS resources

• Added latest version custom field for the version vulnerabilities

• Added standard context menus to text editors

• Sitemap tree will display nodes of JSON, XML and SOAP requests and responses with no parameters

• Added force option to form value settings to enforce user specified values

• Optimized attack patterns for JSON and XML attacks by reducing attack requests

• Optimized Common Directories list and removed the limit for Extensive Security Checks policy

• Improved the license dialog to show whether a license is missing or expired

FIXES

• Fixed update dialog to not show in autopilot mode

• Fixed an interim auto update crash

• Fixed typo in Out of Scope Links knowledge base report template

• Fixed an issue in LFI exploiter where XML tags with namespace prefixes was preventing exploitation

• Fixed Controlled Scan button disabled issue for some sitemap nodes

• Fixed parameter anchors in Vulnerability Summary table of Detailed Scan Report template

• Fixed form authentication wizard to use user agent set on currently selected policy

• Fixed zero response time issue for some sitemap nodes

• Fixed dashboard progress bar showing 100%

• Fixed random crashes on license dialog while loading license file or closing dialog

• Fixed Microsoft Anti-XSS Library links on vulnerability references

BUG FIX

• Fixed an issue where an imported NSS file containing multiple version vulnerabilities was throwing exceptions during report generation

Read the blog post for more details about this version

NEW WEB SECURITY TESTS

• OpenSSL Heartbleed checks added

BUG FIX

• Fixed SocketException error which occurs during Heartbleed check

BUG FIXES

• Fixed a bug where application hangs in Heartbleed engine

• Fixed SOAP WSDL parser to parse web services containing .NET System.Data references

• Fixed SOAP WSDL parser to parse web services containing array parameters

Read the blog post for more details about this version

NEW WEB SECURITY TESTS

• DOM based cross-site scripting vulnerability scanning

• Scanning of parameters in URLs

• Nginx web server Out-of-date version check

• Perl possible source code disclosure

• Python possible source code disclosure

• Ruby possible source code disclosure

• Java possible source code disclosure

• Nginx Web Server identification

• Apache Web Server identification

• Java stack trace disclosure

NEW FEATURES

• Chrome based web browser engine for DOM parsing

• URL rewrite rules configuration wizard to scan parameters in URLs

• “Ignore Vulnerability from Scan” option to exclude vulnerabilities from reports

IMPROVEMENTS

• Improved the correctness and coverage of Remote Code Execution via Local File Inclusion vulnerabilities

• Improved cross-site scripting vulnerability confirmation patterns

• Added support for viewing JSON arrays in document roots in request/response viewers

• Added support for Microsoft Office ACCDB database file detection

• Improved DOM parser to exclude non-HTML files

• Improved PHP Source Code Disclosure vulnerability detection

• Improved Nginx Version Disclosure vulnerability template

• Improved IIS 8 Default Page detection

• Improved Email List knowledgebase report to include generic email addresses

• Improved Configure Form Authentication wizard by replacing embedded record browser with a Chrome based browser

• Improved the form authentication configuration wizard to handle cases where Basic/NTLM/Digest is used in conjunction with Form Authentication

• Added a cross-site scripting attack pattern which constructs a valid XHTML in order to trigger the XSS

• Added double encoded attack groups in order to reduce local file inclusion vulnerability confirmation requests

• Added status bar label which displays current VDB version and VDB version update notifications

• Added login activity indicator to Scan Summary Dashboard

• Added a new knowledgebase out-of-scope reason for links which exceed maximum depth

• Updated external references in cross-site scripting vulnerability templates

• Improved DOM parser by providing current cookies and referer to DOM/JavaScript context

• Added several new DOM events to simulate including keyboard events

• Improved the parsing of “Anti-CSRF token field names” setting by trimming each individual token name pattern

• Added support for simulating DOM events inside HTML frames/iframes

• Consolidated XSS exploitation function name (invicti()) throughout all the areas reported

• Removed redundant semicolon followed by waitfor delay statements from time based SQLi attack patterns to bypass more blacklistings

• Changed default user-agent string to mimic a Chrome based browser

• Improved LFI extraction file list to extract files from target system according to detected OS

• Removed outdated PCI 1.2 classifications

BUG FIXES

• Fixed indentation problem of bullets in knowledgebase reports

• Fixed path disclosure reports in MooTools JavaScript file

• Fixed KeyNotFoundException occurs when a node from Sitemap tree is clicked

• Fixed NullReferenceException thrown from Boolean SQL Injection Engine

• Fixed an issue in WebDav Engine where an extra parameter is added when requesting with Options method

• Fixed a bug where LFI exploitation does not work for double encoded paths

• Fixed a bug in Export file dialog where .nss extension isn’t appended if file name ends with a known file extension

• Fixed a bug in Configure Form Authentication wizard where the number of scripts loaded shows incorrectly

• Fixed a bug which occurs while retesting with CSRF engine

• Fixed a bug where retest does not work after loading a saved scan session

• Fixed a bug where Invicti reports out of date PHP even though PHP is up to date

• Fixed a UI hang where Invicti tries to display a binary response in Browser View tab

• Fixed an ArgumentNullException thrown when clicking Heartbleed vulnerability

• Fixed a bug where Invicti makes requests to DTD URIs in XML documents

• Fixed a bug in Scan Policy settings dialog where list of user agents are duplicated

• Fixed a typo in ViewState MAC Not Enabled vulnerability template

• Fixed a bug in auto updater where the updater doesn’t honour the AutoPilot and Silent command line switches

• Fixed XSS exploit generation code to handle cases where input name is “submit”

• Fixed a bug that prevents invicti.exe process from closing if you try to close Invicti immediately after starting a new scan

• Fixed a UI hang happens when the highlighted text is huge in response source code

• Fixed issues with decoded HTML attribute values in text parser

• Fixed session cookie path issues according to how they are implemented in modern browsers

• Fixed scan stuck at re-crawling issue for imported scan sessions

• Fixed highlighting issues for possible XSS vulnerabilities

• Fixed a crash due to empty/missing URL value for form authentication macro requests

• Fixed a NullReferenceException in Open Redirect Engine which occurs if redirect response is missing Location header

• Fixed an error in authentication macro sequence player happens when the request URI is wrong or missing

Read the blog post for more details about this version

NEW FEATURE

• New option available to specify the type of parameter when configuring URL rewrite rules, e.g. numeric, date, alphanumeric

IMPROVEMENTS

• Improved the performance of the DOM Parser

• Improved the performance of the DOM cross-site scripting scanner

• Optimized DOM XSS Scanner to avoid scanning pages with same source code

• Changed the default HTTP User agent string of built-in policies to Chrome web browser User agent string

• Improved selected element simulation for select HTML elements

• Added new patterns for Open Redirect engine

BUG FIXES

• Fixed a bug in WSDL parser which prevents web service detection if XML comments are present before the definitions tag

• Fixed a bug in WSDL parser which prevents web service detection if an external schema request gets a 404 not found response

• Fixed a bug that occurs when custom URL rewrite rules do not match the URL with injected attack pattern and request is not performed

• Fixed a configure form authentication wizard problem where the web browser does not load the page if the target site uses client certificates

• Fixed a crash in configure form authentication wizard that occurs when HTML source code contains an object element with data: URL scheme is requested

• Fixed a bug in DOM Parser where events are not simulated for elements inside frames

• Fixed a cookie parsing bug where a malformed cookie was causing an empty HTTP response

NEW WEB SECURITY TEST

• Added Bash Command Injection Vulnerability (Shellshock Bug) check.

NEW FEATURE

• Added exploitation support for Remote Code Evaluation and Command Injection engines.

FIX

• Fixed a bug in WSDL parser that crashes application when a type is recursively referenced.

NEW WEB SECURITY TEST

• Added Insecure Transportation Security Protocol Supported (SSLv3) vulnerability check (POODLE vulnerability)

BUG FIXES

• Fixed a specific issue where generic email addresses were not being reported.

• Fixed form authentication configuration wizard problem where it couldn’t handle pages with popups.

• Fixed an issue where Invicti was crashing when the application is closed during report generation.

• Fixed a crash which occurs on systems where Trebuchet MS font is missing

• Fixed 2 Heartbleed engine bugs.

BUG FIXES

• Fixed a bug in custom URL rewrite detection where encoded URL paths are not matched with the provided patterns.

• Fixed a bug that occurs while displaying details of an XSS vulnerability discovered on a redirected page.