Acunetix Standard & Premium

New Features

• Implemented the detection for BREACH vulnerabilities.
• Implemented the detection of Compression Ratio Info-leak Made Easy (CRIME) SSL/TLS exploits.
• Added detection for OpenX 2.8.10 backdoor.
• Added detection of vBulletin versions 4.1+ and 5+ customer number leak.
• Improved DeepScan to provide better coverage.
• Improved SQL injection detection for HSQLDB databases.
• Improved XSS detection.
• Added ability to select/unselect all items in a folder when using the option “after crawling let me choose the files to scan”.
• Fixed custom 404 browser navigation bug
• Filenames encoded as UTF-8 are now properly displayed.

Improvements

• Improved DeepScan to provide better coverage.
• Improved SQL injection detection for HSQLDB databases.
• Improved XSS detection.
• Added ability to select/unselect all items in a folder when using the option “after crawling let me choose the files to scan”.

Bug Fixes

• Fixed custom 404 browser navigation bug
• Filenames encoded as UTF-8 are now properly displayed.

New Features

• Introduced a new compliance report for OWASP Top 10 2013
• Introduced detection of AngularJS template injections
• Added detection of Adobe ColdFusion critical vulnerability APSA13-03 (CVE-2013-3336)
• Added detection of nginx stack-based buffer overflow (CVE-2013-2028)
• Added detection of Horde/IMP Plesk Webmail Exploit
• Added detection of missing X-Frame-Options header (used to prevent Clickjacking attacks)
• Added a test checking for Basic Authentication over HTTP
• Added a test checking for Flask Debug Mode
• Added a test checking for Struts2/XWork Remote Code Execution
• Added detection of MediaWiki Chunked Uploads Security Check Bypass
• Added detection for Plupload XSS vulnerability (included in WordPress versions 3.5, 3.4.2, 3.4.1, 3.4, 3.3.3 and 3.3.2 and other applications)

Improvements

• Reduced false positives in XSS detection
• Improvements to Web Server Default Welcome Page script
• Reduced false positives reported by Blind SQL Injection
• Improvements in the detection of Sensitive Directories
• Added patterns for Python error messages and stack traces in the Text Search script.

Bug Fixes

• Fixed an issue in PHP AcuSensor
• In some situations, the Login Sequence Recorder misidentified connections to HTTPs sites when working through the Acunetix Web Vulnerability Scanner proxy
• Fixed crash in the crawler when external JavaScript files where processed from a site with AcuSensor enabled
• Fixed a false positive in Microsoft IIS Tilde Directory Enumeration
• Fixed issues where scheduled scans with recursion are not rescheduled if they cannot start because of scan restrictions
• Fixed a bug with Amazon S3 Public Buckets audit KB items being reported multiple times

New Functionality

• Added a test for Kayako Fusion v4.51.1891 – Multiple Web Vulnerabilities
• Added various tests for Apache Tomcat
• Added a test for CKEditor 4.0.1 Cross-Site Scripting vulnerability
• Added a test for Moveable Type 4.x Unauthenticated Remote Command Execution
• Implemented detection of Virtual Hosts on the target server
• Implemented jQuery 1.9 support
• Added a test for subversion 1.7 (.svn) repositories
• Added a test for Parallels Plesk SQL Injection Vulnerability (CVE-2012-1557).
• Implemented some tests looking for various Unicode transformation issues such as Best-Fit Mappings, Overlong byte sequences and Ill-Formed Sub-sequences
• Added header input schemes for folders
• Added identification of file names in input scheme parameter values. Any file names detected are subsequently crawled

Improvements

• Various improvements to XSS tests
• Improved Possible_Sensitive_Directories script
• Improved jQuery attr() support
• Improved Virtual Host Directory Listing test
• The report of 404 – Page Not Found now instructs users to checks the Referrers tab for a list of pages linking to the broken link

Bug Fixes

• Fixed a crash that occurs infrequently when configuring a scheduled scan
• Fixed various minor issues in the scan scheduler

New Features

• New report template for ISO 27001

New Security Checks

• During a scan Acunetix WVS checks if the MongoDB web interface is open on the external interface
• Check for included scripts which are from an invalid hostname
• Added a new module for testing Slow HTTP Denial of Service attacks like Slowloris
• Added a new security check that tries to guess various internal virtual hosts (information disclosure)
• Checks for phpLiteAdmin default passwords

Improvements

• Improved the SQL Injection detection for SQLite3
• Further improved the Cross-Site Scripting security check
• Added detailed descriptions to all the Acunetix WVS security scripts
• Removed all broken web references in vulnerability reports and added several new ones
• Improved the Joomla! security scripts for more enhanced security scanning of Joomla! portals

Bug Fixes

• Fixed a text wrapping issue in the compliance reports
• Fixed an issue where the CSA engine was being executed multiple times against the same file during a scan
• User-Agent header is now included with the in-session check request
• Login Sequence Recorder now uses the timeout value specified from settings
• Fixed several crashes when the Login Sequence Recorder was used against some specific websites

New Features

• Schedule up to 2,000 website security scans using a CSV file.
• Ability to exclude WSDL inputs from a scan from the WSDL scan wizard.

New Security Checks

• Added a new security check for IIS global.asa / global.asax backup files.
• Added a new remote code execution security check for vbseo 3.6.0.
• New arbitrary PHP code execution security check for Drupal.
• New information disclosure security check for Drupal.
• Added several web security checks for Ekton CMS.
• New XSS security check that can find vulnerabilities in Referrer headers.

Improvements

• Scheduler UI now supports pagination for faster load time.
• Improved XSS vulnerabilities detection in URIs.
• Improved Input Fields entries for better crawling of websites.

Bug Fixes

• Client certificates are now being used from the Login Sequence Recorder.
• Fixed a crash in the compare scans template.
• Fixed an AcuSensor injection problem with .NET Framework 4.0 applications.
• Fixed several Sensitive Directory vulnerabilities false positives.
• Fixed a Login Sequence Recorder crash.