The Linux Foundation and the Laboratory for Innovation Science at Harvard recently released a Report on the 2020 Free/Open-Source Software Contributor Survey. One of the primary conclusions of this report was the fact that free/open-source software developers often have a very negative approach to security….
Cache poisoning denial-of-service attack techniques
Attacks related to cache poisoning represent a clearly visible web security trend that has emerged in recent years. The security community continues to research this area, finding new ways to attack. As part of the recent release of Invicti, we have added new checks related…
2020 – The Year in Review
The year 2020 won’t go down in history as one of the best, for sure. However, it has actually led to some positive developments. Let us take a look at 2020 in the world of web application security, share our own experiences, and point out…
Managing scans using PowerShell and the Invicti API
In the previous installment of this series, we have shown you how to manage Invicti scans using Bash and the Invicti API. In this article, you will learn how to do the same using PowerShell. As an example, we will create a PowerShell V7 script…
Invicti update introduces support for macOS Big Sur, support for ShadowRoot, improved CSRF token handling, and new vulnerability checks
A new Invicti update has been released for Windows, Linux and macOS: 13.0.201217092. This Invicti update introduces support for macOS Big Sur, ShadowRoot, and includes a substantial improvement in the handling of CSRF tokens. It also introduces the detection of web cache poisoning DoS, client-side…
Invicti Stance on the SolarWinds Hack
We at Invicti and Invicti are deeply concerned with the aftermath of the SolarWinds hack and offer our deepest commiserations to all the security personnel who are facing this situation just before Christmas, and to SolarWinds themselves who have been an unwilling agent to the…
Are You Keeping Up with Web Application Security?
Opinion: Almost every business that has computers buys an antivirus solution. However, relatively few businesses that have their own websites buy vulnerability scanners. I believe that most people don’t buy solutions to protect their web applications not because they don’t feel that it’s necessary but…
Scanning a Google OAuth 2.0 web application
One of the most important qualities of a professional web application vulnerability scanner is the ability to reach every part of the web application, including the protected areas. While many scanners struggle with this, Invicti supports several authentication mechanisms and offers an easy way to…
How To Benchmark a Web Vulnerability Scanner?
You’ve made the right decision to improve your web application security stance and perform regular web application scanning. However, there are several renowned web vulnerability scanners on the market and you have to choose one. How do you do that? As a first step, you…