Get a demo
AppSec with Zero Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo

Invicti Standard 22 Nov 2019

NEW FEATURES

  • Added a scan search feature which is accessible from the CTRL+K shortcut that allows searching for anything in the scan
  • Added a configuration wizard for GitLab Send To Action
  • Added a Web Application Firewall tab to the Options dialog
  • Added AWS WAF integration
  • Added Cloudflare WAF integration
  • Added SecureSphere WAF integration
  • Added an Auto WAF Rule tab to the Scan Policy Editor dialog
  • Added a Send To Tasks dialog to display the Send To Action and WAF Rule task’s status
  • Added a configuration wizard for “rest.testsparker.com” into the Start a New Website or Web Service Scan dialog
  • Added a What’s New panel to the right hand side of the Welcome Dashboard, which shows the latest blog posts
  • Added OTP support to the Form Authentication tab in the Start a New Website or Web Services Scan dialog
  • Added “localhost.invicti” host resolution support to allow remote connections to localhost

NEW SECURITY CHECKS

  • Added a new Security Check – HTTP Parameter Pollution (HPP)
  • Added a new Security Check – BREACH Attack Detection
  • Added Out-of-Date checks for Ext JS
  • Added Oracle Cloud and Packet Cloud SSRF attack patterns

IMPROVEMENTS

  • Improved progress bar estimation by populating engine runtimes instead of request count
  • Improved the Scan Performance node by including engine runtimes in the Knowledge Base
  • The Download buttons in the Local File Inclusion Exploitation panel are renamed to Get
  • Improved statistical information in the scan reports
  • Improved Custom 404 settings in the Knowledge ase report 
  • Improved the Knowledge Base check icon 
  • Improved the display of OAuth2 Authentication information on reports 
  • Added Culture Info to error reporting information
  • Renamed the F5 Big-IP ASM WAF Rules button in the Reporting tab
  • Added an Apply button to the Options window, so the dialog stays open until the Save button is  clicked
  • Improved the Custom Field Editor dialog to validate custom field values before saving them
  • Improved the I/O Docs Importer to support the latest version
  • Improved the Jira Send To Action to support a new Security Level field 
  • Updated Trello Send To Action wizard to hide inactive boards
  • Improved the Crawler and Attacker to identify links separately according to their Accept header. (application/json and application/xml are commonly used in Rest APIs. Invicti can identify and attack for both mime types.)
  • Improved the OpenAPI (Swagger) parser to import links more than once according to their Accept header
  • Updated the AdNetworks file which is used by Invicti to block ad networks
  • Improved the Update Available dialog UI
  • Improved the Report Policy Editor UI.
  • Improved Apache Struts attack patterns by randomizing the attack payloads
  • Improved the Custom Scripting API docs
  • Improved parsing the JavaScript code written inside HTML element attributes
  • Improved the Crawler to detect links with application/xml and application/json headers commonly used in REST APIs, so Invicti can attack each link separately
  • Improved Progress panel’s Request per Second setting, to that its value can be viewed by clicking its label
  • Added the ability to parse OAuth2 access token response headers to get the access token value

FIXES

  • Fixed an issue that caused very long URLs to become invisible in the vulnerability report
  • Fixed an issue that caused the Target Website or Web Service URL dropdown list’s delete button to become invisible in the Start a New Website or Web Service Scan dialog
  • Fixed a false-positive report of a Windows Username Disclosure in the vulnerability report issue
  • Fixed the problem where the Windows Username Disclosure attack pattern did not match invalid file characters
  • Fixed the problem where a null Scan Profile name was displaying when opening a scan file
  • Fixed an issue where headers were duplicating when imported from a Swagger file.
  • Fixed the license expiration to occur a day after the license Expiration date
  • Fixed an issue that caused a Collection Modified exception when restarting Invicti after changing the storage directory
  • Fixed an issue where the HTTP Request / Response panel did not open when the Sitemap root node was selected
  • Fixed an issue in the Request Builder where the changes in the Raw request tab were not being saved
  • Fixed an issue that caused the name of the vulnerability to be blank in the Report Policy Editor dialog
  • Fixed a High dpi issue in the Update Available dialog
  • Fixed an issue that caused the Context button to overlay information counts in the File menu
  • Fixed the URI format exception that occured on the SSRF configuration screen
  • Fixed an issue that caused the tab key not to work in the Request Builder
  • Fixed an issue where encoded characters and new line characters appeared in the exploit responses in JSON format
  • Fixed an issue where the application name was captured as the version in the Java Servlet Version Disclosure pattern
  • Fixed an issue where some console commands were reported as proofs of exploit even though they had not been executed in the code evaluation
  • Fixed an issue where the Report Policy Editor dialog was showing html encoded values in the grid view and in the Edit dialog
  • Fixed an issue where report template changes were lost when the Cancel button clicked while searching in the  Report Policy Editor dialog
  • Fixed an issue where the Dom Parser occasionally made requests to excluded or out of scope URLs
  • Fixed an issue where relative links found during a DOM simulation were sometimes not added to the link pool
  • Fixed a request timeout default value tooltip that was displaying in the  HTTP Request settings
  • Fixed property names in the Redmine Send To Actions fields
  • Fixed an issue that caused the vulnerability URL to change when running a custom script on a vulnerability originally detected also by using a custom script
  • Fixed an issue that caused the UI to freeze when activating or deactivating licenses
  • Fixed an issue that caused the UI to freeze when verifying OAUTH settings
  • Disabled layout customization in the Manual Authentication and Test Credential screens
  • Fixed an issue that caused the scan manager to request a login URL in the OAuth2 Authentication settings when the Web Cache Deception security check group was disabled
  • Fixed an issue that caused late UI loading when the Scan Profile contained too many Imported Links
  • Fixed JSON and XML request identifiers to detect the type properly when content contains whitespace characters
  • Handled communication errors that occured while testing credentials
  • Fixed the log for corrupted variation information
  • Fixed a NullReferenceException that was occasionally thrown in the Additional Websites tab in the Start a New Website or Web Service Scan dialog
  • Fixed a performance issue caused when the number of the Sitemap nodes increases
  • Fixed the Regex Pattern of SQLite error message patterns
  • Updated the Remedy sections of some vulnerability report templates.
  • Fixed the internal proxy localhost’s handling when adding the loopback override to the system’s {roxy settings
  • Fixed misleading logout detection warnings shown during the retest of cookie vulnerabilities
  • Fixed an issue that caused the system to crash when sorting the Sitemap
  • Improved ApacheStruts to report where it would be possible for the attack to succeed at least one time
  • Fixed a NRE in the Signature Detection
  • Fixed the issue where some proofs were duplicated in the Knowledge Base
  • Fixed extensive CPU usage on cloud instances and virtual machines
  • Fixed a Set-Cookie response header parsing issue that occured where empty name/value pairs were skipped and cookie attributes were incorrectly parsed as name/value pairs
  • Fixed the ArgumentNullException error that occured when a null parameter value was sent to the Request Builder
  • Fixed the Knowledge ase’s Out of Scope Links resource problem 
  • Fixed I1 item’s title in the Vulnerability Editor dialog, available from the Report Policy dialog to display as ‘No Message’
  • Fixed the Asana Send To Action field, as an identifier field has changed in the Asana API
  • Fixed the issue where Raw and Builder tabs were not synchronized in the HTTP Request Builder
  • Fixed an incorrect localization issue that occurred while displaying custom field values of vulnerabilities
  • Fixed an issue that caused the Issues and Sitemap panels to open before opening a scan session
  • Fixed a problem where the Search box background color changed when there were no results
  • Users are now allowed to enter custom HTTP methods in the Request Builder panel when the Raw request body is enabled
  • Fixed an ArgumentNullException that was thrown when trying to refresh the OAuth2 access token after resuming an imported scan
  • Fixed a couple of alignment problems in reports 
  • Fixed the last file name cache problem 
  • Fixed the Request response word wrap and border problem solved. 
  • Removed capitalization from titles in reports 
  • Fixed an issue where the AutoComplete Enabled Vulnerability was being falsely reported if input fields included a new password option
  • Fixed a NullReferenceException that was thrown when the headers were null in the Webhook Send To Action