Acunetix WVS Build History

Build v9.0.20140313 – 13th March 2014

New Features

Improvements

  • Limited the maximum number of variations from HTML forms
  • Login Sequence Recorder will now skip recording automatic redirects
  • Improved automatic in-session detection (Login Sequence Recorder)
  • PHP AcuSensor – Added the ability to handle PHP5 Closures and improved handling of large data
  • Improved ELMAH Information Disclosure script to cover default installation locations
  • Improved ability to identify redirect variants in JavaScript code
  • Improvements to the Backup File Tests
  • Improvements to the Directory Traversal Tests
  • Improvements to the File Inclusion Tests
  • Added support for HSQL Error Messages
  • Improvements to the Possible Sensitive Directories Tests
  • Improvements to the Possible Sensitive Files Tests
  • Improvements to the URL Redirection script

Bug Fixes

  • Fixed a number of memory leaks
  • Fixed an issue causing the scan to hang caused by invalidated sessions
  • Fixed an issue causing the scan from crawler executed all tests twice
  • Fixed a crash in the Session Manager caused by invalid server dates
  • URL finder regex hanged on some basic inputs
  • EOutOfMemory exceptions during the execution of scripts will not cause WVS to crash. The scan will be stopped when such an exception is encountered
  • Fixed issue with false positives not being saved to disk when marked from the Vulnerability Information panel
  • Ignore external scripts feature in DeepScan was sometimes still processing external scripts

Build v9.0.20140206 – 6th February 2014

New Features

Improvements

  • Scanning of WordPress sites has been made more efficient
  • Improved coverage of ASP.NET based websites
  • Improved XSS testing script

Bug Fixes

  • Fixed bug in the pagination of the Scheduler Web Interface
  • The Login Sequence Recorder was ignoring the maximum size HTTP option
  • Fixed an issue causing the crawler to create multiple entries of the same custom cookie.
  • Fixed a bug causing the HTTP sniffer to always listen on localhost
  • Fixed a bug in the console application preventing scanning from older saved crawl results.
  • Fixed a crash caused at start-up caused by the DeepScan agent not starting.

Build v9.0.20140115 – 15th January 2014

Improvements

  • WVS will warn user if the login sequence failed to make a successful login and disables the login steps.
  • Various improvements in the detection of Blind SQL Injection
  • Various improvements in DeepScan
  • Better handling of web servers that don’t send HTTP headers in the response (HTTP 0.9)
  • Improved Readme Files script
  • JSON parser can now handle unnamed inputs

Bug Fixes

  • XSS vulnerabilities are no longer reported if the initial request is redirected to another host
  • Fixed an issue with the Crawler depth limitation
  • Fixed issue with Crawler request counter when used with login sequence
  • “Add to request” function in HTTP Editor was not working in raw HTTP request tab
  • Fixed a bug that was causing false positives in the JavaScript Libraries Audit script
  • Fixed some false positives in Possible Sensitive Directories script.

Build v9.0.20131216 – 16th December 2013

New Features

Improvements

  • Improved test for WordPress OptimizePress Theme file upload vulnerability.
  • The scanner will now indicate that a scan can take long time to complete, allowing the user to tweak the scan settings if needed.
  • Various improvements to the Login Sequence Recorder
  • Improved the test looking for possible form caching (look for missing “pragma: no-cache” header).
  • It is now possible to use multiple input values for HTML inputs using the format: $(choice1,choice2). These can be configured from Configuration > Scan Settings > Input Fields.
  • Speed improvements gained by streamlining the number of requests performed by some checks.
  • Better handling of some uncommon HTTP status codes.
  • The user-agent of the Login Sequence Recorder can now be configured to use the one configured in WVS (by default, it uses Internet Explorer)
  • Directory Traversal script now provides better handling of Java Web Applications.
  • Improved the calculation of the average response time during a scan

Bug Fixes

  • Sites with a high response time were showing incorrect scan statistics.
  • Fixed rewrite detection on nginx servers with phpfastcgi.
  • Fixed some false positives in SQL Statement in comment.
  • Better handling of very long VIEWSTATE strings.
  • Improved handling of Windows based websites by providing better support for case insensitive filesystems
  • Scan from HTTP Proxy log entry was not working correctly
  • Fixed a crash caused by specific characters in the URL Encoded Post Data
  • Fixed a false positive in Script_Source_Code_Disclosure.script
  • Fixed some false positives in error messages.
  • Web Services: fixed Out of Bounds error when importing invalid WSDLs.

Build v9.0.20131023 – 23rd October 2013

New Features

  • Introduced the detection of additional DOM XSS vulnerabilities which can be injected in the HTTP GET parameters.
  • Implemented the option to auto-save scan results after the scan is completed. This can be configured from Configuration->Application Settings->Saved scan results. This node also includes the Database settings, which are used for the reporting database.

Improvements

  • Reduced number of requests made by PerFolder scripts by making some optimizations in the scripts.
  • Improved Readme_Files script to reduce some false positives originating from sites using a custom 404 page

Bug Fixes

  • Affected file was sometimes set incorrectly for DOM XSS vulnerabilities.
  • Fixed an issue causing the scan to check for possible sensitive files/folders when AcuSensor is enabled, and thus such files would already be known.
  • Saving scan results to reporting database and loading of saved scans sometimes caused WVS to crash
  • The Edit Request Variables option in the HTTP editor was not visible
  • Fixed Out of memory crash in AcuSensor for PHP when “mbstring.func_overload” is enabled.
  • Fixed memory leak affecting large websites

Build v9.0.20131107 – 11th November 2013

New Features

Improvements

  • Improved XSS testing script.
  • From an alert, clicking on the affected file takes the user to the file in the site structure. This is useful when additional information on the affected file is required (such as the referrers in the case of Broken links, or the source of the web page)
  • DOM XSS alerts will include more information (such as the HTML written for document.write)
  • Improved Code Execution script to find more specific issues and reduce the number of requests performed

Bug Fixes

  • Fixed an issue causing application deadlock.
  • Fixed false positives shown in broken links
  • Fixed some false positives with Script_Source_Code_Disclosure.script
  • Fixed DOM XSS false positives
  • Fixed an issue with Analyze_Parameter_Values script causing the script not to parse relative paths correctly
  • Fixed false positives with Slow HTTP Denial Of Server script

Build v9.0.20131023 – 23rd October 2013

New Features

  • Introduced the detection of additional DOM XSS vulnerabilities which can be injected in the HTTP GET parameters.
  • Implemented the option to auto-save scan results after the scan is completed. This can be configured from Configuration->Application Settings->Saved scan results. This node also includes the Database settings, which are used for the reporting database.

Improvements

  • Reduced number of requests made by PerFolder scripts by making some optimizations in the scripts.
  • Improved Readme_Files script to reduce some false positives originating from sites using a custom 404 page

Bug Fixes

  • Affected file was sometimes set incorrectly for DOM XSS vulnerabilities.
  • Fixed an issue causing the scan to check for possible sensitive files/folders when AcuSensor is enabled, and thus such files would already be known.
  • Saving scan results to reporting database and loading of saved scans sometimes caused WVS to crash
  • The Edit Request Variables option in the HTTP editor was not visible
  • Fixed Out of memory crash in AcuSensor for PHP when “mbstring.func_overload” is enabled.
  • Fixed memory leak affecting large websites

Build v9.0.20131009 – 10th October 2013

New Features

  • Added a test looking for ReadMe documentation files. The information contained in these files could help an attacker identify the web application being used and sometimes the version of the application. It’s recommended to remove these files from production systems
  • Added a test for HTML injection vulnerabilities
  • Added a test for weak passwords in Joomla! Administrative interface
  • Added a test for weak passwords in the Django Administrative interface
  • Added a test for WordPress PHP Object Injection affecting versions lower than 3.6.1

Improvements

  • Various updates in DeepScan resulting in improved site coverage
  • Update in the way that the HTTP Editor detects the host header from the URL
  • Acunetix now displays a warning if the user closes the application during a scan
  • The Port scanner timeout connection can be configured in milliseconds, allowing for further fine-tuning of the timeout

Bug Fixes

  • Fixed a crash in the user interface when certain components where updated from different threads
  • Base64 tool has been updated to ignore CRLF
  • Fixed issue causing the CSRF checks to never finish in some cases
  • Fixed issue causing the Reporter to invalidate the default report in some cases when the settings were changed
  • Fixed issue causing the default report button was not working in welcome screen
  • Fixed crawler stall when maximum number of pages reached
  • Fixed various memory leaks in crawler
  • Various updates to the Scanning Profiles

Build v9.0.20130904 – 5th September 2013

New Features

Improvements

  • Improved DeepScan to provide better coverage.
  • Improved SQL injection detection for HSQLDB databases.
  • Improved XSS detection.
  • Added ability to select/unselect all items in a folder when using the option “after crawling let me choose the files to scan”.

Bug Fixes

  • Fixed custom 404 browser navigation bug
  • Filenames encoded as UTF-8 are now properly displayed.

Build v9.0.20130814 – 15th August 2013 – NEW VERSION

New Features

  • FULL support for HTML5
  • Introduced DeepScan Technology which enhances crawling of JavaScript based web sites, including AJAX and Single Page Applications (SPA). DeepScan is powered by WebKit.
  • Improved support for mobile friendly web sites
    • Improved ability to crawl such sites
    • User is given option to scan mobile friendly version of website
  • Drastically increased the detection of DOM-based XSS
  • Launched Acunetix AcuMonitor used to detect vulnerabilities that can only be detected using an intermediate server. The use of AcuMonitor requires registration.
  • Detection of Blind XSS using AcuMonitor
  • Detection of Server Side Request Forgery (SSRF) using AcuMonitor
  • Detection of Host Header Attacks using AcuMonitor
  • Detection of Email Header Injection using AcuMonitor
  • Detection of XML External Entity (XXE) using AcuMonitor
  • New parameter: /SaveCrawlerData. This new parameter can be used to save the crawler data following a scan from command line.
  • At the end of a scan, the command line output includes scan statistics showing the number of files detected, number of requests, average response and other data which is shown in the main application.
  • Introduced http://testhtml5.vulnweb.com – a new HTML 5 test site which hosts various HTML5 specific vulnerabilities

Improvements

  • Blind SQL Injection script has been revamped and now provides better detection and significantly reduces false positives
  • Crawler has been updated to support 303 and 307 HTTP Redirection Status codes
  • Updated HTML Authentication Auditing script
  • When a vulnerability is identified, Acunetix will stop checking for variations of the vulnerability. This decreases the scan time, and prevents reporting the same vulnerability multiple times on the same input field.
  • HTTP Authentication now allows saving of websites with underscore in the domain names
  • Backup file script has been updated to not display large binary files in HTTP editor.

Bug Fixes

  • Fixed non-responsive user interface caused when saving scan results.
  • Fixed issue where some scans incorrectly reported the alert ‘Password type input with auto-complete enabled’ multiple times incorrectly.
  • Some scans used to run the perServer scripts twice, thus taking longer and reporting the same vulnerability twice.
  • Scheduler sometimes reported an ‘Unknown State’ when a scan is cancelled.
  • Various other bug fixes