Build v6.5.20100616 – 16th June 2010
Change
- All vulnerability checks which used http://.acunetix.com test websites, now are using http://.vulnweb.com
Build v6.5.20100601 – 19th April 2010
New Feature
- Added OWASP top 10 2010 report template
Bug Fix
- Fixed: Proxy crashes when processing some specific SSL traffic
Build v6.5.20100419 – 19th April 2010
Bug Fix
- Fixed: Access violation when the application exits
Build v6.5.20100407 – 7th April 2010
Bug Fixes
- Fixed: Login Sequence Recorder was not using client certificates when recording a login sequence
- Fixed: Login Sequence Recorder was not using the configured User Agent string
- Fixed: HTTP Sniffer was not handling some specific web authentication properly
Build v6.5.20100303 – 3rd March 2010
New feature
- Added a new option to export results to HTTP Fuzzer
New Security Checks
- Test for XML External Entity Injection
- Test for XML Injection
Improvements
- Improved directory traversal vulnerability check
- Improved Cross-site Scripting (XSS) vulnerability checks
Bug Fixes
- Fixed: access violation when the application exists
- Fixed: access violation when protocol was terminated in NotifyCaller function in LSR
- Fixed: AbortVulnXML OnFirstAlert was not imported from settings
- Fixed: Form values were not encoded correctly when submitted from JavaScript (CSA engine)
Build v6.5.20100210 – 10th February 2010
New security check
- Test for Cross Site Scripting in the Referrer header
Improvement
- Acunetix Firefox extension now supports latest Firefox release
Bug Fixes
- Crawler: Html decode form inputs before usage
- Fixed an infinite recursion when crawler reported an external link from the same host but on a different port
- Fixed an issue with the crawler with parsing robots.txt file
- Web Services scanner: Fixed parsing of WSDL files with attributes
Build v6.5.20100203 – 3rd February 2010
New security checks
- 8.3 DOS filename source code disclosure
- Apache Tomcat Directory Host Appbase authentication bypass vulnerability
- Apache Tomcat WAR File directory traversal vulnerability
- Apache stronghold-info enabled
- Apache stronghold-status enabled
- ColdFusion 9 Solr Service exposed
- Error page path disclosure
- Error page web server version disclosure
- File inclusion RFI list
- Checks for multiple vulnerabilities in XAMPP
- Server-Side Includes (SSI) injection on Unix
- Server-Side Includes (SSI) injection on Windows
- ASP.NET error messages when requesting URL like |.aspx
Improvements
- Added more variants to FCKeditor arbitrary file upload
- Updated cross site scripting in path security checks
- Updated directory listing security checks
- Updated directory traversal on Unix security checks
- Updated file upload security checks
- Updated LDAP injection security checks
- Updated possible sensitive files security checks
- Updated XPath injection security checks
Bug Fixes
- Workaround for window.open used with NULL parameter
- Notify elements that they are unbidden
- Notify form if an input was removed
- Include select element values in submitted data
- Fixed: HttpProt was sending content length with CONNECT
- Fixed: Crawler didn’t consider post data for links from CSA engine; some where ignored
- Fixed: Login sequence recorder was sending requests synchronously
Build v6.5.20100111 – 11th January 2010
New security checks
- Test for File Upload IIS bug filename.asp;.jpg
- Test for WP-Forum 2.3 vulnerabilities
- JBoss rmi ping (network script)
Bug Fixes
- Bugfix: Modified forms notifications from CSA
- Bugfix: CSA: Workaround for window.open with null parameters
- Fixed: In some specific scenarios the scheduler queue was restarting on its own
- Fixed: Node was not expanding automatically when manually adding a new logout link in the LSR
Build v6.5.20091215 – 15th December 2009
New security checks
- JBoss BSHDeployer MBean
- JBoss checks from RedTeam’s paper
- JBoss HttpAdaptor JMXInvokerServlet
- JBoss Server MBean
- JBoss ServerInfo MBean
- JBoss Web Console JMX Invoker
- phpShop v0.8.1 Multiple Vulnerabilities
- Invision Power Board <= v3.0.4 Local PHP File Inclusion and SQL Injection
Improvements
- Improved Blind SQL injection tests to reduce false positives
- Added better JBoss server detection
- Better detection for Postgre SQL injections
Bug Fixes
- Fixed: GUI crashes when specific settings are changed in the Port Scanner node
- Fixed: Login Sequence recorder was retaining post data when redirecting to the same page
Build v6.5.20091130 – 30th November 2009
Bug Fixes
- Fixed: crash in TM_MultiRequest_Parameter_Manipulation module
- Fixed: bug in crawler related with GetVar encoding
Build v6.5.20091124 – 24th November 2009
New
- New security checks of AcuSensor Technology
- curl_exec() url is controlled by user
- PHP preg_replace used on user input
- PHP super-globals-overwrite
- PHP unseriazlie used on user input
- Other new security checks of Acunetix WVS
- osCommerce authentication bypass
- Apache Tomcat insecure default administrative password
- Apache Tomcat directory traversal
- Checks for PHP invalid data type error messages
- Check for possible remote SWF inclusion
- Added further checks for possible sensitive files; general tests per server
- Added further checks for possible sensitive directories; general tests per server
- Added a new security check for SQL injection in the authentication header (basic authentication, base64 encoded)
- Added AlertIfTextNotFound group parameter to invert search and issue an alert if a specified text is not found
Improvements
- Renamed Weak password module to Authentication module since now it includes much more authentication security checks
- Improved Cross-site scripting in URI checks to include Ruby on rails security checks
- Improved Application errors security checks
- Introduced 3 new setting parameters for the crawler in Settings.XML file:
- 262144
- 256
- 1000
Bug Fixes
- Fixed: false positives issued in weak password alert
- Fixed: WSDL importer crash when importing recursive complex elements
- Fixed: Crawler proxy request handling changed to decode the input name/value
- Fixed Vulnerability Editor to show group parameters with default values if no VulnXML template is used
- Changed HTTP_Anomalies to log PHP errors and save the results in a file (instead of alerts)Changed HTTP_Anomalies to log PHP errors and save the results in a file instead of alerts
- Hidden VulnXML properties for alerts that are not using vulnxml default template in Vulnerability Editor
- Adjusted VulnXML to reduce the number of false positives for Blind SQL injection timing tests
- Updated CSA engine; delete the BOM characters from script sources
- Updated URL_Helper; UrlEncode/Decode modified not to use str := str + ch and to validate hex characters after %
- Updated File_Inputs; possible values are limited in size now
Build v6.5.20091027 -27th October 2009
Bug Fixes
- Fixed: Redirect on LoginSequenceStep was not followed correctly
- Fix in URL Rewrite module to remove GetVars before matching rules
Build v6.5.20091012 -12th October 2009
Bug Fixes
- Fixed: Memory leak when invoking state change handler
- Fixed: Item index for an item which has just been inserted fails in the Browserframe
- Fixed: Error in indexing the get variables when redirecting in Session management
Build v6.5.20091005 – 5th October 2009
New
- Added a new check for SVN repositories
Improvements
- Improved MultiRequest paramenter manipulation; now using the form matcher to match parameter values
- Improved SQL injection tests
- Improved Application error tests
Bug Fixes
- Fixed: Links from HTML comments and other sources that are not trusted where not checked if they are from the same host as the base
- Fixed: Login sequence not working properly with HTTP authentication
- Fixed: MessageDlg was used in inittempfiles in console mode
- Fixed: WinInet bug to resent the request if the server accepts client certificates
- Fixed: Redirect from index.php to index.php was not working
Build v6.5.20090917 – 17th September 2009
New
- Added two new blind SQL injection tests
- Added a new scanning profile for stored XSS only
- Added HTTP verb tempering using POST method check
Improvements
- Improved appearance for compliance report by adding visual markets and several other presentation enhancements
Bug Fixes
- Fixed temporary files access issue
- Fixed issue where HTTP Proxy was dublicating the connection: keep-alive header
- Fixed issue where HTTP Proxy was putting the authorization header from fake basic authentication into server request
- Fixed a problem where credentials configured through command line where not working properly in particular situations
Build v6.5.20090813 – 13th August 2009
Improvements
- HTML forms settings node was renamed to Input Fields. This node now can also be used to pre-define web services operations values.
- New SQL Injection tests added
- New XSS tests (unicode) added
Build v6.5.20090728 – 28th July 2009
New Features
- Manual Intervention module: better support for CAPTCHA and modern authentication mechanisms
Improvements:
- Added new variants of blind SQL injection tests (now testing both AND and OR boolean operators)
- Added new tests for SQL Injection with charset GBK/Big5
- Added new variants for Cross site scripting
Bug Fixes
- Fixed several issues with CSA (Client Script Analyzer) engine.
Build v6.5.20090622 – 22nd June 2009
Improvements
- Better cookies handling in several modules
- Implemented exception handler in Login Sequence Recorder
Bug Fixes
- Handled issue when non-responsive hosts triggered download dialog
Build v6.5.20090618 – 18th June 2009
New Features
- Implemented Blind SQL Injection (timing) for web services scanner
- Implemented HTTP authentication for web services scanner
Bug Fixes
- Fixed problem related to File Inclusion in AcuSensor Technology
- Fixed a problem in ssl_ping network script
Build v6.5.20090519 – 20th May 2009 – NEW VERSION
New Features
File upload forms vulnerability checks
- New Login Sequence Recorder; supports much more authentication forms and web technologies
- Session Auto Recognition module; if the session is invalidated or logged out during crawling, the scanner will automatically replay the login sequence without the need of manual intervention
- Actions drop down menu; for each selected node, the actions drop down menu is activated showing all possible functions
- Much more checks and alerts for JSP, Java and Tomcat web server
Major Improvements
- Improved cookie management and session handling to support modern dynamic websites
- Port scanner and Network Alerts results will appear in a separate node in the results tree
- Users can import Version 6 settings to Version 6.5
- Added blind SQL injection timing test using MySQL’s sleep and MS SQL’s waitfor function. This will help in discovering particular blind SQL injections that do not report a change on the page