Acunetix Standard & Premium

New Features

• A new option that allows you to specify a different email address for each configured scan in the scheduler.
• HTTP Fuzzer number generator now supports padding, e.g. you can use a leading zero i.e. from 01 to 10.
• A new option to specify if the latest cookie from the scanned website should be used rather than the one discovered during crawling.
• New option to force scanner to not overwrite user specified custom cookies with newer cookies from the scanned website.
• Ability to import multiple HTTP Sniffer captures to the same crawl.
• Ability to merge HTTP Sniffer captures to existing website crawls.

New Security Checks

• Added a test for .Net Cross Site Scripting (Request Validation Bypassing).
• New security check for MediaWiki security issues.

Bug Fixes

• Fixed a Crossdomain in an XML false positive.
• Fixed the Scan Wizard back button issue; there were instances were it was not working correctly.
• Fixed a bug in the scanner to scan only website files found during a crawl.
• Fixed a memory leak in the Client Script Analyser engine.
• The Login Sequence Recorder User-Agent string is now the same in both the header and in the scripting code.
• Fixed a bug within the WSDL scanner “Customize” button.

New Security Checks

• Added a number of new HTML 5 Cross-site scripting security checks
• Content-type text /xml responses are now being checked for XSS vulnerabilities
• Using Windows 8.3 short filenames techniques to check for information disclosure
• Checks for Microsoft IIS Tilde directory enumaration problems
• A number of new security checks for Webadmin
• Checking for MySQL, RubyonRails and phpMyAdmin SQL dump files on web applications
• File disclosure via XXE Injection tests for Zend Framework
• Information disclosure checks in environment variables

Improvements

• Improved Directory Traversal security checks
• Less false positives reported by the HTML Forms security checks

Bug Fixes

• Custom cookies paths are now set correctly to the start URL
• Login Sequence Recorder now executes Javascripts even if there are js errors
• New discovered input parameters variations are added to the list of input variations rather than ignored

New Security Check

• Acunetix WVS checks if your PHP-CGI installation is vulnerable to remote code execution. For further information regarding this type of vulnerability, read the PHP-CGI advisory article here.

New Features

• Ability to edit scheduled scans. No need for scheduling new scans every time you wish to change a scan setting.
• Amend multiple scheduled scans simultaneously by selecting them and applying the required global changes.
• Save all your scanned results and access them at any time from your scheduler’s scan history. You can also delete your scanned results from the web-based scheduler.
• A new setting has been introduced to configure the maximum number of pages during a crawl.

Improvements

• Improved Cross-Site Scripting (XSS) tests.
• The web-based scheduler has been improved to run better in the latest version of Internet Explorer.
• Enhanced SQL injection tests to reduce the false positives reporting even more.

Bug Fixes

• The scheduled scans can be correctly imported after upgrading to a more recent build of Acunetix WVS 8.
• The false positives settings node can now support changes from multiple instances at the same time.
• Web Service Definition Language (WSDL) Scanner URL edit box is now able to save history.

New Security Checks

• Acunetix WVS 8 runs security tests for Joomla 1.6.x/1.7.x/2.5.x Privilege Escalation
• Acunetix WVS 8 provides security tests Joomla 1.7/2.5 Core SQL Injection

Improvements

• More advanced security checks for MongoDB and Rails Mass Assignment.

Bug Fixes

• The crash in the Login Sequence Recorder has been fixed.
• The Login Sequence Recorder is accurately parsing websites which send back GZIP encoded content, even if it was not specified in the Accept-Encoding header.
• The Acunetix Reporter has improved the handling of missing scans reports.
• The Acunetix Reporter Console supports spaces within the specified parameters.
• The Acunetix Reporter accepts longer input names.

New Features

• Manipulation of inputs from URL’s
• Automatic IIS 7 rewrite rule interpretation
• Support for custom HTTP headers during automated scans
• Imperva Web Application Firewall integration
• Multiple instance support for scanning multiple websites in parallel
• New web-based Scheduler
• Automatic custom 404 error page recognition and detection
• Scan settings templates
• Simplified Scan Wizard
• Smart memory management
• Real-time Crawler status
• Scan termination status included in report
• Web application coverage report
• Configuration of log files retention

New Vulnerability Classes Checks

• HTTP Parameter Pollution
• MongoDB Injection
• NodeJs Injection
• Expression Language Injection

New Web Security Audit Checks

• Check website content for Bazaar source code repository
• Check website content for Mercurial source code repository
• Check website content for source code GIT repository
• Disclosure of HTML Forms in redirect pages
• Security audit of alternative PHP cache
• Check for insecure preg replace in PHP
• Apache httpOnly Cookie Disclosure
• Elmah Information Disclosure
• Checks for Options web server method
• PHP Hash Collision Denial Of Service
• Plone&Zope Remote Command Execution
• Checks for Reverse Proxy bypass
• CakePHP web application Audit
• Web applications Configuration File Disclosure
• phpThumb web application audit
• Struts2 Remote Code Execution
• Tiny MCE web application audit
• Uploadify web application audit
• Webmail web application audit

Improved the Web Security Audit Scripts for

• SQL Injection
• XSS (Cross site scripting)
• Code Execution
• CRLF Injection
• Directory Traversal
• File Inclusion
• PHP Code Execution
• Backup Files
• Sensitive Text Search
• Secure Socket Layer configuration
• Error Messages
• ASP.NET Application Trace
• .htaccess File Configuration
• Http Verb Tampering
• PHPInfo / PHP Configuration
• Possible Sensitive Directories Disclosure
• Possible Sensitive Files Disclosure
• SQL Injection In Basic Authentication
• SQL Injection In URI
• SVN Repository Disclosure
• Trojan Scripts
• File Upload Form Audits
• Generic Oracle Padding
• Web Form based Authentication
• LDAP Injection
• Script Source Code Disclosure
• XFS and Redir
• XPath Injection
• Apache Geronimo Default Administrative Credentials
• ColdFusion v9 Solr Exposed
• Error Pages with Path Disclosure
• Frontpage Authors Passwords
• Frontpage Extensions Enabled
• IIS Unicode Directory Traversal
• JBoss Web Server Configuration
• Unprotected phpMyAdmin Interface
• Web Server Version Checks
• XML External Entity Injection
• FCKEditor security audit
• Struts2 XWork Remote Code Execution

Improvements

• Smart Memory management (ability to scan larger websites)
• Detection of more web security vulnerability variants