Acunetix Standard & Premium

New Features

• New report template for ISO 27001

New Security Checks

• During a scan Acunetix WVS checks if the MongoDB web interface is open on the external interface
• Check for included scripts which are from an invalid hostname
• Added a new module for testing Slow HTTP Denial of Service attacks like Slowloris
• Added a new security check that tries to guess various internal virtual hosts (information disclosure)
• Checks for phpLiteAdmin default passwords

Improvements

• Improved the SQL Injection detection for SQLite3
• Further improved the Cross-Site Scripting security check
• Added detailed descriptions to all the Acunetix WVS security scripts
• Removed all broken web references in vulnerability reports and added several new ones
• Improved the Joomla! security scripts for more enhanced security scanning of Joomla! portals

Bug Fixes

• Fixed a text wrapping issue in the compliance reports
• Fixed an issue where the CSA engine was being executed multiple times against the same file during a scan
• User-Agent header is now included with the in-session check request
• Login Sequence Recorder now uses the timeout value specified from settings
• Fixed several crashes when the Login Sequence Recorder was used against some specific websites

New Features

• Schedule up to 2,000 website security scans using a CSV file.
• Ability to exclude WSDL inputs from a scan from the WSDL scan wizard.

New Security Checks

• Added a new security check for IIS global.asa / global.asax backup files.
• Added a new remote code execution security check for vbseo 3.6.0.
• New arbitrary PHP code execution security check for Drupal.
• New information disclosure security check for Drupal.
• Added several web security checks for Ekton CMS.
• New XSS security check that can find vulnerabilities in Referrer headers.

Improvements

• Scheduler UI now supports pagination for faster load time.
• Improved XSS vulnerabilities detection in URIs.
• Improved Input Fields entries for better crawling of websites.

Bug Fixes

• Client certificates are now being used from the Login Sequence Recorder.
• Fixed a crash in the compare scans template.
• Fixed an AcuSensor injection problem with .NET Framework 4.0 applications.
• Fixed several Sensitive Directory vulnerabilities false positives.
• Fixed a Login Sequence Recorder crash.

New Features

• A new option that allows you to specify a different email address for each configured scan in the scheduler.
• HTTP Fuzzer number generator now supports padding, e.g. you can use a leading zero i.e. from 01 to 10.
• A new option to specify if the latest cookie from the scanned website should be used rather than the one discovered during crawling.
• New option to force scanner to not overwrite user specified custom cookies with newer cookies from the scanned website.
• Ability to import multiple HTTP Sniffer captures to the same crawl.
• Ability to merge HTTP Sniffer captures to existing website crawls.

New Security Checks

• Added a test for .Net Cross Site Scripting (Request Validation Bypassing).
• New security check for MediaWiki security issues.

Bug Fixes

• Fixed a Crossdomain in an XML false positive.
• Fixed the Scan Wizard back button issue; there were instances were it was not working correctly.
• Fixed a bug in the scanner to scan only website files found during a crawl.
• Fixed a memory leak in the Client Script Analyser engine.
• The Login Sequence Recorder User-Agent string is now the same in both the header and in the scripting code.
• Fixed a bug within the WSDL scanner “Customize” button.

New Security Checks

• Added a number of new HTML 5 Cross-site scripting security checks
• Content-type text /xml responses are now being checked for XSS vulnerabilities
• Using Windows 8.3 short filenames techniques to check for information disclosure
• Checks for Microsoft IIS Tilde directory enumaration problems
• A number of new security checks for Webadmin
• Checking for MySQL, RubyonRails and phpMyAdmin SQL dump files on web applications
• File disclosure via XXE Injection tests for Zend Framework
• Information disclosure checks in environment variables

Improvements

• Improved Directory Traversal security checks
• Less false positives reported by the HTML Forms security checks

Bug Fixes

• Custom cookies paths are now set correctly to the start URL
• Login Sequence Recorder now executes Javascripts even if there are js errors
• New discovered input parameters variations are added to the list of input variations rather than ignored

New Security Check

• Acunetix WVS checks if your PHP-CGI installation is vulnerable to remote code execution. For further information regarding this type of vulnerability, read the PHP-CGI advisory article here.

New Features

• Ability to edit scheduled scans. No need for scheduling new scans every time you wish to change a scan setting.
• Amend multiple scheduled scans simultaneously by selecting them and applying the required global changes.
• Save all your scanned results and access them at any time from your scheduler’s scan history. You can also delete your scanned results from the web-based scheduler.
• A new setting has been introduced to configure the maximum number of pages during a crawl.

Improvements

• Improved Cross-Site Scripting (XSS) tests.
• The web-based scheduler has been improved to run better in the latest version of Internet Explorer.
• Enhanced SQL injection tests to reduce the false positives reporting even more.

Bug Fixes

• The scheduled scans can be correctly imported after upgrading to a more recent build of Acunetix WVS 8.
• The false positives settings node can now support changes from multiple instances at the same time.
• Web Service Definition Language (WSDL) Scanner URL edit box is now able to save history.