Acunetix Standard & Premium

New Features

• New version of .NET AcuSensor (requires removal of the sensors installed in the web applications – check this blog post for more info)
• Implemented a test looking for JSP source code disclosure via SOH (start of header)
• Added a script for parsing specific Java error messages to improve crawling coverage and discover new content.

Improvements

• Improved backup config files discovery
• Request cookies will now be automatically processed from proxy log requests and used during a scan
• The Crawler now processes untrusted URLs even if they do not belong to the host being scanned.

Bug Fixes

• Fixed a number of false positives in the SQL injection vulnerability checks
• Limit AST parsing to files smaller than 1Mb
• Fixed an SQL injection vulnerability in the reporter.

New Features

• Implemented support for automatically scanning Drupal and Joomla! web applications using a proprietary database of vulnerabilities
• Implemented support for CVSS v3.0 for most vulnerabilities
• Added a test for HTTP Response Splitting in Node.js (CVE-2016-2216)
• Added a test for Magento Cacheleak vulnerability
• Added a test looking for ASP.NET diagnostic pages
• Implemented a test looking for XXE (XML External Entity injection) in SAML (Security Assertion Markup Language) payloads
• Added a test for vulnerabilities presented in the Perl Jam 2 presentation
• Added a test for Atlassian Jira 6.0.* <= 6.1.4 DOM-based XSS
• Added a test for AngularJS client-side template injection
• Added a test for Rails Dynamic Render to RCE (CVE-2016-0752)
• Added a test looking for LiteSpeed request header injection
• Added a test for Path Traversal in Oracle GlassFish Server Open Source Edition
• Parse Javascript files using an Abstract Syntax Tree Parser to extract various information useful for the crawler.

Improvements

• Improved Blind and Error-based SQL injection tests
• Improved XSS tests
• Big improvements to the XXE (XML External Entity) tests
• Improved static crawling by parsing of JavaScript event handler parameters.
• Improve Email header injection test based on the paper from http://www.mbsd.jp/Whitepaper/smtpi.pdf

Improvements

• Improved the description for all the vulnerability checks in Scanning Profiles

New Features

• Added a new test looking for development configuration files such as Vagrantfile, Gemfile, Rakefile and others
• Added a test for Insecure response with wildcard ‘*’ in Access-Control-Allow-Origin
• Added detection of Cross Site Scripting (XSS) in the mobile-touch event handlers
• Added a test for CVE-2015-5956 – Typo3 Core sanitizeLocalUrl() Non-Persistent Cross-Site Scripting
• Added a test looking for CVE-2015-5603: HipChat for JIRA plugin – Velocity Template Injection
• Added a test looking for vulnerable project dependencies by analyzing the contents of composer.lock
• Added a test for CVE-2015-5161 – XML eXternal Entity Injection (XXE) on PHP FPM (FastCGI Process Manager), affecting various versions of Zend Framework and ZendXML
• Added a test for CVE-2014-0114 – Class Loader Manipulation via Request Parameters affecting Apache Struts 1
• Added a test for CVE-2015-4670: Directory Traversal to Remote Code Execution in AjaxControlToolkit
• Added a test looking for sensitive files such as .mysql_history, .bash_history and others. Acunetix will verify the contents of these files to reduce false positives caused by custom 404s.

Improvements

• Updated database of WordPress core and plugin vulnerabilities.
• Added more checks for vulnerable JavaScript libraries.
• Improved WADL parsing to support more representation types.

Bug Fixes

• Fixed some false positives in JavaScript libraries audit.
• Fixed a false positive in File Inclusion script.
• Fixed an issue causing JSON and XML inputs not being checked for XSS.
• Fixed SSL audit bug that is triggered when server_name extension was not sent to the server during SSL negotiation.

New Features

• New Login Sequence Recorder which supports Single-Sign-On (SSO) and OAuth-based authentication.
• Database of 1200 WordPress-specific vulnerabilities, including checks for WordPress core and popular WordPress plugins.
• Improved scanning of Java / J2EE web applications
• Improved scanning of Restful Web Services, including parsing of WADL files
• Improved scanning of web applications implemented in Ruby on Rails
• Detection of XML External Entity (XXE) via REST APIs
• Crawling a website can now be pre-seeded using HAR files and exports from Fiddler, Burp, Selenium and the Acunetix Sniffer
• Introduced the detection of links to websites known to host malware or used for phishing
• Improved support for WSDL-based web services by introducing support for xsd:include, xsd:import and wsdl:import