The XML-RPC protocol was originally designed to simplify cross-platform communication between applications. However, recent security research has revealed that it can be exploited for IP disclosure attacks. This article explores how XML-RPC functions, its vulnerabilities in WordPress, and how attackers can use it to expose…
Identifying WordPress Websites On Local Networks (behind Firewalls) and Bruteforcing the Login Pages
This article explores how attackers can leverage the XSHM attack to detect WordPress sites operating within internal networks or behind firewalls. It also demonstrates how this method can be used to carry out brute-force login attempts on these protected installations. According to statistics from w3techs,…
Latest product updates
All announcements about Invicti product updates and new releases are now exclusively available on our changelogs page. For each release, we publish notes to announce new features, new security checks, improvements, and bug fixes. Information about our latest product updates and previous release notes are…
Updated: Launching critical severity in Invicti Standard & Premium
With the release of Invicti Standard and Invicti Premium versions 23.8 and 23.9 comes the addition of critical severity as a new vulnerability classification. Find out which vulnerabilities have changed to critical here. What’s changing? Our vulnerability classification system (High-Medium-Low) has expanded to include a…
Invicti sunsets support for Windows 8 and Server 2012
A new Invicti Premium update has been released for Windows and Linux: 15.7 We are sunsetting the support for Windows 8, Server 2012, and Server 2012 R2. To provide you with the best DAST product experience, we regularly update Invicti. As a result of these…
Invicti releases a security check for Fortinet RCE flaw
This Invicti release introduces a new security check for the Fortinet RCE flaw (CVE-2022-39952). The FortiNAC, a network security solution, was discovered to have a vulnerability with a high CVSS score of 9.8, known as CVE-2022-39952. Fortinet disclosed the security issue on February 16. The…
Invicti improves default roles
A new Invicti Premium update has been released for Windows and Linux: 15.4 This Invicti release improves the default roles. Invicti offers role-based access control (RBAC) to efficiently manage user access. Thanks to RBAC, you can limit or authorize user access to Invicti based on the…
Invicti improves user experience and notifications
A new Invicti Premium update has been released for Windows and Linux: 15.1 This Invicti release updates its user interface and the notifications list. The user interface features a new navigation menu, which prioritizes features based on how frequently you may need them. The most…
Invicti releases support for RHEL 9, updates CWE report, and improves PHP IAST AcuSensor
A new Invicti Premium update has been released for Windows and Linux: 15.0.221007170. This Invicti release introduces support for Red Hat Enterprise Linux (RHEL) 9, which has been released earlier this year. The PHP IAST AcuSensor can now be used with web applications that take…