The Invicti API gives you the opportunity to automate tasks to increase efficiency – especially when you can accelerate the integration of functionality with other components of your workflow. In this example, we will build on a previous article, where we’ve shown you how to…
Author Archives Kevin Attard Compagno
THE AUTHOR
Kevin Attard Compagno
Technical Writer
Technical Writer
What is the Invicti target knowledge base
With the latest update to Invicti, we introduced a new feature called the target knowledge base. Every time you scan a target, Invicti gathers and stores information about it. This information includes paths that make up the site structure, the location of forms and their…
Step-by-step asset discovery with Invicti
One of the biggest pains of larger businesses is that they usually do not have a single library that lists all their assets. There are many reasons for this, for example, many businesses are actually a merger of several organizations and their structure tends to…
Managing scans using Python and the Invicti API
In the two previous installments of this series, we have shown you how to manage Invicti scans using Bash and PowerShell together with the Invicti API. In this article, you will learn how to do the same using Python. As an example, we will create…
Scanning authenticated web assets with the Login Sequence Recorder
Most web applications and websites require some form of authentication – either as a whole or in an area. Many web vulnerability scanners struggle with such authenticated web assets. While some scanners are able to detect standard authentication forms and mechanisms, in the case of…
Managing scans using PowerShell and the Invicti API
In the previous installment of this series, we have shown you how to manage Invicti scans using Bash and the Invicti API. In this article, you will learn how to do the same using PowerShell. As an example, we will create a PowerShell V7 script…
Scanning a Google OAuth 2.0 web application
One of the most important qualities of a professional web application vulnerability scanner is the ability to reach every part of the web application, including the protected areas. While many scanners struggle with this, Invicti supports several authentication mechanisms and offers an easy way to…
Managing scans using Bash and the Invicti API
The Invicti API allows you to programmatically manage your Invicti tasks, including triggering scans for targets, checking the status of your scans, and retrieving a list of vulnerabilities found by your scans. This example can serve as a primer for building such programmatic tools. In…
Scanning a GraphQL API for vulnerabilities
Since June 2020, Invicti supports the increasingly popular API query language – GraphQL. In this article, we want to show you step-by-step how to scan an API defined using GraphQL. To do this, you will first create an intentionally vulnerable API and its GraphQL definition,…