Netsparker Cloud Change Log
Netsparker Cloud Update - 23rd July 2018

NEW FEATURE

IMPROVEMENTS

  • Improved text shown after deleting a website
  • Improved text shown on Authentication Verifier Settings page
  • Improved help text for Recaptcha setting shown on Service Settings page
  • Removed 2FA disable button for users who do not have required access permission (previously displayed as disabled)
  • Improved timer behaviour of validation code shown on SMS Settings page 
  • Improved order of vulnerabilities in several reports
  • Response content will not be rendered if it's higher than 10MB, instead response data can be downloaded from scan results page
  • Refactored and improved performance of reports which can be exported from Scan Results page
  • Added market place links for Jenkins, TeamCity and Bamboo plugins shown on Integrations page
  • Improved validation messages for JIRA integration
  • Improved samples for new website API documentation
  • Changed wording on General Settings page
  • Simplified endpoint format for Authentication Verifier settings

BUG FIXES

  • Fixed a bug where if previous scan failed with domain resolution error, subsequent scans failed unexpectedly with the same error
  • Fixed a bug where imported Swagger file was not parsed during scanning
  • Fixed a bug where multiple SAML configurations might be configured with same configuration identifier
  • Fixed an issue where Agent could not be disabled on Manage Agents page
  • Fixed an issue where Jenkins icon was not displaying properly on IE
  • Fixed a bug where sorting was not working for Next Execution Time on Scheduled Scans page
  • Fixed a bug where product update links were not displaying correctly
  • Fixed a bug where configured Scan Policies' user agent was not used in Authentication Verifier
  • Fixed documentation links for SSO providers
  • Fixed API authorization error thrown on notification endpoints for Team Members
  • Fixed an issue where custom reports were not displayed on Scan Results page
  • Fixed an issue where Knowledge Base data was not saved properly
Netsparker Cloud Update - 29th June 2018

BUG FIXES

  • Fixed a database connectivity issue which was occurring when pool size was not sufficient (onpremises only)
  • Fixed an issue where installation wizard was shown when database connectivity was lost (onpremises only)
  • Fixed an issue in agent endpoint where scan file names were not set as expected (onpremises only)
Netsparker Cloud Update - 6th June 2018

IMPROVEMENTS

  • Improved audit logs' contents.

BUG FIXES

  • Fixed an issue in "/scans/new" API endpoint.
  • Fixed an issue where SMTP settings was not persisted as expected.
  • Fixed an issue in IP restriction settings.
  • Fixed an issue where vulnerabilities' request/response details were not displayed properly.

Netsparker Cloud Update - 29th May 2018

NEW FEATURES

  • Added SSO (Single Sign-On) support (onpremises only)
  • Added an option to "Scan Policy > HTTP Request" settings to capture HTTP Requests
  • Added installation wizard for onpremises installation (onpremises only)
  • New plugin for integration with Bamboo
  • Added code highlighting support for vulnerability request and response
  • Added "Scans per Website Group" report type to Reporting page
  • Added an option to general settings to configure retention period for raw scan files (onpremises only)
  • Netsparker Desktop integration: ability to import and export scans between the scanners.
  • Added Server-Side Template Injection (SSTI) vulnerability checks.
  • Added the OWASP 2017 Top Ten classifications report template.

NEW SECURITY CHECKS

  • Expect-CT security checks.
  • Added various new web applications in the application version database.
  • Added out of date checks for Hammer.JS., Phaser., Chart.js., Ramda., reveal.js., Fabric.js., Semantic UI., Leaflet., Foundation., three.js., PDF.js., Polymer.

IMPROVEMENTS

  • Added elapsed time information for ongoing scans
  • Added an option to scan reports page for hiding addressed issues
  • Improved Agents page to display configured agents' versions (onpremises only)
  • Added CVSS score to JSON vulnerabilities report
  • Improved user profile to display trial expiration date
  • Improved response status messages on the API documentation
  • Added Netsparker Cloud issue link to created tickets for supported issue tracking systems (JIRA, TFS, GitHub and Manuscript)
  • Improved help text for schedule scan's license errors
  • Allowed team members to manage their own notification settings
  • Added "Copy to Clipboard" functionality for API settings
  • Improved Incremental Scan page to configure maximum scan duration
  • Added an icon for scans launched by continuous integration systems
  • Added "LookupId" unique identifier for vulnerabilities to "/scans/report" API endpoint
  • Added "FirstSeenDate" and "LastSeenDate" fields for vulnerabilities to "/scans/report" API endpoint
  • Added "CreatedAt" and "UpdatedAt" fields for "/websites/list" API endpoint
  • Added "/vulnerability/list" API endpoint to list vulnerability templates
  • Improved logs for client certificate validation errors
  • Crawler can now parse multiple sitemaps in a robots.txt file.
  • Added support for parsing swagger documents in yaml format.
  • Added support for parsing relative meta refresh URLs.
  • Improved parsing of websites using React framework.
  • Content-Security-Policy-Report-Only header is not reported as an interesting header.
  • Variations are retested before starting an incremental scan.
  • Improved JavaScript content check performance while detecting out of date versions.
  • Renamed FogBugz send to action to its new name Manuscript.
  • GitHub Send to action now works with organization accounts and private repositories.
  • Added support for handling HTTP 307 redirects.
  • DS_STORE files are discovered and parsed.
  • Added WAF (Mod Security) rule generation support for out of band vulnerabilities.
  • Improved MySQL double encoded string attacks.
  • New Extensions scan policy settings to specify which extensions should be crawled and attacked.
  • Added "Disallowed HTTP Methods" settings to scope options on the new scan page.

BUG FIXES

  • Fixed an issue where empty value was not accepted for Excluded URLs
  • Fixed an issue where invitation was not deleted after an account deleted
  • Fixed font size for highlighted fields on vulnerability details
  • Fixed an issue where validation was not working as expected for Netsparker Hawk settings
  • Fixed an issue where VDB update date was not persisted as expected
  • Fixed some possible vulnerabilities missing [Possible] indicator in title.
  • Fixed highlighting problem for "Password Transmitted over HTTP" vulnerability.
  • Fixed the incorrect Possible LFI caused by the persisted OOB RCE pattern on the page response.
  • Fixed incorrect "[Possible] WS_FTP Log File Detected" vulnerability.
  • Fixed Hawk validation error by not following redirects.
  • Fixed the issue where a vulnerability is not reported when the cookie contains a CSRF token.
  • Fixed the issue where static detection vulnerabilities are treated as fixed after a retest even though they are not.
  • Fixed the issue where CSRF token in the cookie is not reported when token is in the form action.
  • Fixed the issue on GitHub send to action where the test passed but vulnerability issue cannot be created.
  • Fixed the SSL check hang on HTTP only hosts.
  • Fixed LFI engine by not analyzing source code disclosure on binary responses.
  • Fixed a validation issue for some Swagger documents.
  • Fixed the issue where CSP keywords are not reported when used without single quotes.
  • Fixed mailto: and javascript: links which were incorrectly reported as mixed content.
  • Fixed incorrect source code disclosures reported in binary responses.
  • Fixed incorrect UNC Server And Share Disclosure vulnerability reports.
  • Fixed out of date version reporting behavior when no ordinal is found in version database.
  • Fixed Lighttpd version disclosure detection signatures.
  • Fixed a Swagger parsing issue.
Netsparker Cloud Update - 18th April 2018

BUG FIXES

  • Fixed a bug where crawling is not working as expected.
  • Fixed a security vulnerability in form authentication verification.

Netsparker Cloud Update - 6th March 2018

NEW FEATURES

IMPROVEMENTS

  • Improved XML and date samples displayed in API documentation.
  • Improved input validation in the reporting page.
  • Improved on-premises installation document for customers using load balancer.
  • Renamed FogBugz integration to Manuscript.
  • Improved validation of custom cookies.
  • New scans launched outside scan window will be automatically queued
  • Increased character limit for website name.
  • Added more details to scanner agent's startup log.
  • Improved installation error message of internal scanner agent.
  • Improved vulnerability request/response data page performance.
  • Improved the navigation of issues and scans. 
  • Improved validation of custom 404 settings in the Scan Policy.
  • Added a "Copy to Clipboard" button for cURL samples in API documentation.
  • Improved API documentation to show request details.
  • Changed date/time format from 24-hour clock to 12-hour clock.

BUG FIXES

  • Fixed HTTP response data that was not displayed correctly for stored XSS vulnerability.
  • Fixed the Github integration which ws not working due to TLS 1.2 connectivity problem.
  • Fixed an issue where loading icon does not rendering correctly in IE11.
  • Fixed a font size problem in the PCI DSS reports.
  • Fixed the info messages that were not fitting in the screen on small resolutions.
  • Fixed an issue in which scan profiles could be created with same name.
  • Fixed a bug with website verification emails which were not being sent.
  • Fixed a bug with vulnerability counts in HIPAA and PCI DSS compliance reports.
Netsparker Cloud Update - 31th January 2018

NEW FEATURES

  • Added agent grouping support which allows to launch scans in specified agent group. This feature is only available for on-premises standard agents.
  • New API endpoints for getting website and website group details.

IMPROVEMENTS

  • Changed Netpsparker Cloud application's loading icon.
  • Added an icon to indicate external links.

BUG FIXES

  • Fixed an issue where scans are not launched on on-premises AWS scanner agents.
  • Fixed an issue where realtime scan results are not displayed correctly in IE11.
  • Fixed an issue where proofs are not displayed correctly on vulnerability details section.

Netsparker Cloud Update - 13th December 2017

NEW FEATURES

  • Realtime scan results
  • Added out of the box integration support for: FogBugz, Github and TFS issue tracking systems.
  • Grouping of notifications so a single email or SMS alert is sent with a list of all alerts rather than multiple individual alerts.
  • New API endpoint for launching group scans.
  • Scheduling for incremental scans both from the web UI and API.
  • New API endpoint for generating custom scan reports.
  • New scan policy setting to define Web (Session and Local) Storage.
  • New Header Authentication settings to manually add request headers with authentication information.
  • Added support to import links from CSV files.
  • Added support for parsing of gzipped sitemaps.

NEW SECURITY CHECKS

  • Check for reflected Code Evaluation in Apache Struts 2 (CVE-2017-12611).
  • Check for Remote Code Execution in Apache Struts (CVE-2017-5638).

IMPROVEMENTS

  • Scan Time Window setting is now available to new group scans page.
  • Improved scan stability and performance.
  • Improved default Form Values settings.
  • Updated external references for several vulnerabilities.
  • Updated default User-Agent HTTP request header string.
  • Changed API endpoints to return 201-Created response status code for new resources.
  • Added several UI improvements for WCAG guidelines compliance.
  • Improved the email template that reports issues.
  • Added "Attack Parameters" information to Scanned URLs report.
  • Renamed the "Important" vulnerability severity to "High".
  • Added Form Authentication performance data to Scan Performance knowledge base node.
  • Improved Active Mixed Content vulnerability description.
  • Improved DOM simulation for events attached to document object.
  • Added parsing of "Alternates", "Content-Location" and "Refresh" response headers.
  • Improved CSP engine performance by checking CSP Nonce value per directory.
  • Changed sqlmap payloads to start with sqlmap.py, including the .py extension.
  • Added --batch argument to sqlmap payloads.
  • Removed Markdown Injection XSS attack payloads.
  • Added ALL parameter type option to the Ignored Parameters settings.
  • Added gtm.js (Google Tag Manager JS library) to the default excluded scope patterns.
  • Updated the Accept HTTP header value for default scan policy.
  • Added CSS exclusion selector supports frames and iframes.
  • Added embedded space parsing for JavaScript code in HTML attribute values.
  • Added parsing source information to Scanned URLs List and Crawled URLs List (JSON) reports.
  • Email disclosure will not be reported for email addresses used in form authentication credentials.
  • Added focus and blur event simulation for form authentication set value API calls.
  • Added more information about HTML forms and input for vulnerabilities found in HTML forms.
  • Added a JavaScript option to specify JavaScript cookies to persist across authentication and DOM simulation.
  • Added Parameter Value column to the Vulnerabilities List report in CSV format.
  • Added match by HTML element id for form values.
  • Added "Ignore document events" to JavaScript settings to ignore triggering events attached to document object.
  • Improved Windows Short Filename vulnerability details Remedy section.
  • URL Rewrite parameters are now represented as asterisks in sqlmap payloads.

BUG FIXES

  • Fixed an issue where AutoSave filename is missing during resuming a scan.
  • Fixed an issue where "Test" button of authentication settings does not work as expected.
  • Fixed an issue where model binding does not work as expected for scan profile API endpoints.
  • Fixed CSRF vulnerability reporting on change password forms.
  • Fixed case sensitivity checks while matching ignored parameters, now it matches case sensitive.
  • Fixed the incorrect disabled external references section in WordPress Setup Configuration File template.
  • Fixed various source code disclosure issues.
  • Fixed an escaping issue with CSS exclusion selectors.
  • Fixed the issue where the basic authentication credentials were not being sent on logout detection phase.
  • Fixed a random DOM simulation exception occurs when site creates popup windows.
  • Fixed a RemotingException occurs on Form Authentication Verifier.
  • Fixed a possible NullReferenceException on Form Authentication.
  • Fixed the broken form authentication custom script when the last line of the script is a single line comment.
  • Fixed huge parameter value deserialization memory usage.
  • Fixed the wrong URLs added with only extension values.
  • Fixed a NullReferenceException which may be thrown while importing a swagger file.
  • Fixed form authentication not triggered on retest.
  • Fixed StackOverflowException in swagger parser thrown while parsing objects containing circular references.
  • Fixed a swagger file parsing issue where target URL should be used when host field is missing.
  • Fixed swagger importer by ignoring any metadata properties.
  • Fixed a NullReferenceException occurs during DOM simulation.
  • Fixed the incorrect URLs parsed on attack responses.
  • Fixed the redundant duplicate HTTP requests issued by Web App Fingerprinter.
  • Fixed ignore parameter issue for parameters containing special characters.
  • Fixed a NullReferenceException that occurs for select elements missing option elements on multipart requests.
  • Fixed missing vulnerabilities requiring late confirmation for incremental scans.
  • Fixed a NullReferenceException may occur on iframe security checks.
Netsparker Cloud Update - 26th September 2017

NEW SECURITY CHECK

  • Added "Out of Band Code Evaluation (Apache Struts 2)" security check (CVE-2017-9805).
Netsparker Cloud Update - 19th September 2017

NEW FEATURES

  • Added scan policy settings for CSRF security checks.
  • Added ability to use custom HTTP headers during scan.
  • Added attacking optimization option for recurring parameters on different pages.
  • Added a new knowledgebase item called Site Profile that lists information about target web site such as the web server operating system, database server, JavaScript libraries used etc.
  • Redesigned the Basic, NTLM, Digest and Kerberos authentication settings which now supports multiple credentials for different URL paths.

NEW SECURITY CHECKS

  • Added Referrer Policy security checks.
  • Added markdown injection XSS patterns.
  • Added HostIP and IPv6 patterns to MySQL and SSH SSRF security checks.
  • Added Database Name Disclosure security checks for MS SQL and MySQL.
  • Added Out of Date security checks for several JavaScript libraries.
  • Added Remote Code Evaluation (Node.js) security checks.
  • Added SSRF detection with server-status.
  • Added user controllable cookie detection.
  • Added Context-Aware XSS detection by generating XSS payloads based on the reflected context without breaking it.
  • Added Default Page checks for IIS 7.0, 7.5, 8.5 and 10.0.
  • Added IIS 10.0 Version Disclosure checks.
  • Added WordPress Setup Configuration File checks.

IMPROVEMENTS

  • Improved design of the group scan email template.
  • Improved accessibility of several pages to follow WCAG guidelines.
  • Optimized compression time while archiving the raw scan files.
  • Added support for allowing users to launch scheduled scans manually.
  • Disabled scheduled scans if the license is expired.
  • Updated the links to several external references.
  • Improved JavaScript and CSS resource parsing.
  • Added DOM simulation options to scan policy optimizer wizard.
  • Improved Mixed Content vulnerability reporting by separating them according to resource types.
  • Improved boolean SQL injection detection for redirect responses.
  • Improved WSDL parsing for files that contain optional extensions.
  • Improved .sql file detection signature.
  • Added extra confirmation for weak credentials detection.
  • Added scan policy option to allow XHR requests during DOM simulation.
  • Added form value for password input types to default scan policy.
  • Increased the maximum response size limit for JavaScript resources.
  • Improved the send to JIRA error message.
  • Added maximum number of option elements per select element to simulate scan policy setting.
  • Added filter 'colon' events scan policy option to filter events that contain colon character in its name during DOM simulation.
  • Improved error based SQLi exploitation by generating prefix/suffix dynamically.
  • Improved command injection vulnerability detection by prepending original parameter value to attack payload.
  • Improved LFI vulnerability detection by detecting HTML and URL encoded PHP source codes.
  • Improved LFI attack patterns.
  • Improved DOM XSS attack patterns.
  • Improved DOM/JavaScript simulation.
  • Improved the performance of email address disclosure detection.
  • Improved the performance of database connection string disclosure detection.
  • Improved the performance of JavaScript library detection.
  • Improved the performance of RoR database configuration detection.
  • Improved Blind Command Injection detection on Linux systems.
  • Improved resource finder to find more hidden resources.
  • Improved support for simulating customized select elements.
  • Improved NTLM, Digest and Kerberos authentication support.
  • Improved DOM simulation stability and performance.
  • Improved the default parameter name list for Parameter Based Navigation.
  • Added NTLM and Digest authentication support to the generated sqlmap and cURL commands.
  • Improved boolean and blind SQL injection checks for MySQL databases.
  • Improved blind SQL injection checks for PostgreSQL databases.
  • Improved reflected and stored XSS detection.
  • HSTS checks now reports missing preload directives.
  • Updated Korean translation.
  • Improved JSON response parsing.
  • Improved DOM based XSS payloads by prepending a URL to referer to make it practically work on web browsers.
  • Improved email disclosure checks by checking host names against to public suffix list.

BUG FIXES

  • Fixed a NullReferenceException which may have been thrown while editing settings of an user.
  • Fixed an issue where email notifications are not sent for unconfirmed phone numbers.
  • Fixed an issue which may have been thrown while deleting an account.
  • Fixed an issue where error based SQLi confirmation is done based on the first seen database signature when multiple signatures appear in source code.
  • Fixed the duplicate import link issue.
  • Fixed an issue where XSS is missed when injected payload is not executed due to a syntax error.
  • Fixed crawling of URLs on pages where base element points to some other URL.
  • Fixes an issue where blacklisted Netsparker attacks prevent further source code disclosures in HTML response.
  • Fixed an issue where mixed content vulnerabilities are missing because DOM simulation is skipped due to missing JavaScript in HTML source.
  • Fixed issues where empty POST parameter is imported and headers added as disabled for Postman files.
  • Fixed an issue where signature fails to match MS SQL username in error messages.
  • Fixed an issue where vulnerability is missed because of that not appending arbitrary value to extra querystring parameter name.
  • Fixed the error caused by null bytes in attack patterns while sending vulnerabilities to JIRA.
  • Fixed an incorrect "Password Transmitted over HTTP" issue for relative URLs on pages redirected to HTTPS addresses.
  • Fixed the NullReferenceException thrown while importing certain HAR (HTTP Archive) files.
  • Fixed incorrect "Interesting Header" report for Content-Security-Policy header.
  • Fixed directory listing is not reported issues on some IIS versions.
  • Fixed the issue where comments in CSS files are not parsed.
  • Fixed the incorrect URL found in CSS comments.
  • Fixed incorrect CSRF vulnerability reports by taking hidden token input into account.
  • Fixed an IndexOutOfRangeException caused by CSP checks.
  • Fixed the signature pattern which fails to match "Programming Error Message (PHP)" in multiple lines.
  • Fixed markdown XSS attack patterns causing incorrect findings.
  • Fixed incorrect "Interesting Header" reports for some headers.
  • Fixed the incorrect http protocol displayed for SSL vulnerabilities.
  • Fixed an issue where DOM simulation is performed for checking XSS once per XPath.
  • Fixed the maximum crawled URL limit exceeded issue.
  • Fixed duplicate resource finder requests.
  • Fixed the WADL import issue where the operation fails for responses with no status codes.
  • Fixed incorrect HttpOnly reports of XSRF-TOKEN cookies, due to its nature these cookies must be accessed from JS code.
  • Fixed the incorrect missing object-src report on CSP checks.
  • Fixed an issue where default crawled value is double-encoded instead of single.
  • Fixed the missing content for Site Profile section of Knowledge Base report.
Netsparker Cloud Update - 21st July 2017

NEW FEATURES

IMPROVEMENTS

  • Decreased scan results' registration time by optimazing database queries.
  • Added several improvements for running Netsparker Cloud on-premises on AWS.
  • Added more information (such as Total Requests and Average Speed) to the detailed scan report.
  • Improved code samples used in API documentation.
  • Improved help text and messages. 
  • Added delete button to website edit page.
  • Improved scanner agent's startup script to ensure agent is started properly.
  • Improved sign-in/logout flow to make user sessions more secure.
  • Reviewed and fixed duplicate IDs in HTML elements.
  • Improved design of the email templates.
  • Updated AWS SDK to the latest version.
  • Added Korean support to scan report API endpoint. 
  • Added support for setting preferred agent name via API.
  • Added status information to preferred agent section on the new scan page.

FIXES

  • Fixed an issue with the archiving of raw scan files.
  • Fixed the total website count which was incorrect on manage website groups page.
  • Fixed the user's date format that was not used while selecting dates on account settings page.
  • Fixed the account settings page which was not displayed properly in high-DPI screens.
  • Fixed a bug where issue counts were not displayed correctly on website dashboard page.
  • "JavaScript - Elements To Skip" setting was is now set properly in new scan policy page.
  • Expired license error is now returned properly in API endpoints.
  • Fixed issues with the order of the websites in the  "Websites That Have Shortest Fix Time" widget.
  • Fixed an error which was being thrown when adding a website via API in Netsparker Cloud on-premises.
  • Fixed CVE links in scan report page.
  • Fixed a bug in website verification API endpoint.
  • Fixed a NRE which was being thrown during exporting CSV reports.
  • Fixed a bug where CSV comma separator is not remembered on Export to CSV pages.
  • Fixed an error which was being thrown during deleting a scan profile.
  • Fixed a bug in website verification API endpoint.
Netsparker Cloud Update - 7th April 2017

New Features

  • A wizard to assist first time users add a new website and setup a web security scan
  • Late confirmation of vulnerabilities (vulnerabilities can be confirmed after the scan has finished with Netsparker Hawk)

New Security Checks

Improvements

  • Improved Boolean SQL Injection detection.
  • Updated the Local File Inclusion vulnerability classifications.
  • Improved Trace/Track security checks.
  • Improved coverage of XSS engine in redirects.
  • Added policy optimization support for SSRF security checks.
  • Added exploit generation support for "Cross-site Scripting via Remote File Inclusion" vulnerability.
  • Added a specialized parser to parse JavaScript responses better to reduce discovering incorrect links.
  • Improved form authentication logout detection by ignoring the responses of some attacks to prevent incorrect logout detections.
  • Added VDB support to Blind & Boolean SQLi post exploitation.
  • Added support for checking Open Redirection vulnerability on Refresh response header.
  • Added the XPath information of the element that causes the DOM XSS vulnerability.
  • Added "Sub Path Max Dynamic Signatures" setting for Heuristic URL Rewrite detection.
  • Added a JavaScript scan policy option to reduce triggered event count during the simulation.
  • Added a JavaScript scan policy option to exclude HTML elements such as logout buttons from event simulation by CSS selectors.
  • Added checks for vulnerabilities which sink into window.name capability for DOM XSS security checks.
  • Improved the coverage of the Local File Inclusion engine so the vulnerability can be found in a full url attack.
  • Changed severity numbers' style on scan result pages.
  • Added support for editing scan time window settings for running scans.
  • Highlighted special fields of vulnerability notes on the scan report page.
  • Settings of completed scans are automatically applied to new scans when a user launches a new scan from the recent scans page or scan report page.
  • Improved notifications email templates.
  • Improved help text by adding netsparker.com article links to relevant sections.
  • Improved input validation for request rate limit settings on the scan policy page.
  • Added support for remembering previously entered filters on list pages.
  • Allowing users to select CSV separator while export scan reports.
  • Added support to allow users to re-verify logout settings on the form authentication verification dialog.

Bug Fixes

  • Fixed several issues related to DOM parsing and simulation.
  • Fixed a NullReferenceException thrown by HTTP Methods checks.
  • Fixed a StackOverflowException caused by JSON responses with too many nested elements.
  • Fixed Proof of Concept generation during post exploitation for time based SQLi checks.
  • Fixed a NullReferenceException while confirming a Boolean SQLi vulnerability.
  • Fixed an issue where scan is paused when an additional host is unreachable.
  • Fixed typos in CSP vulnerability templates.
  • Fixed an issue where ignored emails are still reported as knowledge base issue.
  • Fixed an issue where source code disclosure is reported in JS and CSS files.
  • Fixed an SQL exploitation issue where executing a SQL query which expected an integer result is no longer giving failure for PostgreSQL database.
  • Fixed a Text Parser issue where single quote characters were being captured as part of links.
  • Fixed the incorrect path disclosure caused by the Shellshock attack.
  • Fixed missing SSRF proofs under Proofs knowledge base.
  • Fixed incorrect encoded parameter names for multipart/form-data forms.
  • Fixed the performance recrawling for DOM XSS checks on websites with lots of links.
  • Fixed the incorrect CR LF encoding issues on proof URLs.
  • Fixed DOM Parser clearInterval JavaScript function simulation.
  • Fixed an issue where stored XSS vulnerability is reported in an XHR response rather than in the page itself which makes XHR request.
  • Fixed an issue where Boolean SQL Injection vulnerability is missed due to crawled parameter value.
  • Fixed an issue where reflected XSS vulnerability is missed because the reflected payload is HTML encoded in an attribute.
  • Fixed an issue where Text Parser does not handle the same referenced JavaScript in different files.
  • Fixed an issue where timezone is not being set correctly when a validation error occurs on the signup page.
  • Fixed a filtering issue on the Manage Team page.
Netsparker Cloud Update - 26th January 2017

New Features

  • Authentication & session verification for form based authentication.
  • Credentials test for Basic and NTLM/Kerberos authentication mechanisms.
  • Support for the Netsparker Hawk infrastructure, used for detecting SSRF and out-of-band vulnerabilities.
  • Added HTTP request rate limiting options to Scan Policy.
  • Added "Ignored Email Addresses" section in Scan Policy.
  • Added accept and reject options for untrusted SSL certificates.
  • Added an option to disable automatic detection of 404 error pages.
  • Support for importation of Postman files.

New Security Checks

Improvements

  • Improved the performance of several link importers.
  • Added "Bearer Token" support for form authentication.
  • Added confirmation for Frame Injection vulnerabilities.
  • Added http: and https: checks for CSP vulnerability detection.
  • Improved link importers - redundant CONNECT requests are now excluded.
  • Optimized attacker performance for links containing single parameter.
  • Optimized crawling parser by skipping DOM simulation on pages with static content.
  • Improved coverage of CORS security check with extra attacks.
  • Removed GWT attacks from file upload security checks.
  • Improved DOM simulation performance.
  • Improved CSS parsing which now follows CSS import directives.
  • Improved coverage of open redirect security checks by adding/updating attacks patterns.
  • Improved logout detection by skipping JavaScript responses.
  • Added support for "HTTP 410 Gone" and "HTTP 451 Unavailable For Legal Reasons" response status codes.
  • Added CVSS information to more vulnerabilities.
  • Updated vulnerability database.
  • Added URL Rewrite mode to Detailed Scan Report.
  • Added support for configuring websites on manage groups page.
  • Improved the UI & UX of several pages.

Bug Fixes

  • Fixed an issue where a “multiple cookies issue” should not be reported.
  • Fixed a JSON parsing issue with text parser.
  • Fixed an HTTP response issue where the response could not be read because only BOM bytes are sent on first read attempt.
  • Fixed an issue where a false positive file upload vulnerability might be reported.
  • Fixed several DOM simulation issues on pages that have many iframe elements.
  • Fixed a NullReferenceException while performing an internal MD5 encoding operation.
  • Fixed an encoding issue on a proof URL of an XSS vulnerability.
  • Fixed an issue where "Shell Script Identified" vulnerability is not found when retested.
  • Fixed URL parsing on pages where the URLs were containing whitespace characters like carriage return and line feeds.
  • Fixed a text parsing issue where absolute URLs were converted to invalid relative URLs.
  • Fixed incorrect protocol detection for protocol-relative URLs.
  • Fixed an issue which occurs during importing websites with unix line endings.
  • Fixed a retest issue which occurs if vulnerable URL contains a dash character.
  • Fixed an issue where SSL details were not shown properly on knowledge base report.

Netsparker Cloud Update - 1st December 2016

New Feature

Improvements

  • Description in Scan Status have been improved to give a better overview.
  • Added a new crawling option Find and Follow New Links. Previously it was hidden and always enabled.
  • Improved the names of the exported reports by adding the report type as prefix in filename.

Bug Fixes

  • Fixed an issue where the target website screenshot was not being captured.
  • Fixed the CSS styles in some knowledge base items in the scan report page.
  • Fixed an issue where the Upload client certificate button was not working.

Netsparker Cloud Update - 17th November 2016

Fixes

  • Fixed a licensing bug in a third-party library.

Netsparker Cloud Update - 2nd November 2016

New Technical Check

  • Added "Cookie Header Contains Multiple Cookies" check

Improvements

  • Improved the Content Security Policy (CSP) and "Misconfigured Access-Control-Allow-Origin Header" vulnerability templates.
  • Improved CSP vulnerability detection by only reporting vulnerabilities on HTML resources.
  • Improved the coverage of the boolean SQL injection vulnerability engine.

Fixes

  • Fixed an issue which was preventing the deletion of multiple websites.
  • Fixed the External CSS, Script and Frame Knowledge Base items which were not considering the port during checks.
  • Fixed an issue in the Open Redirect detection where incorrect URLs may also be reported.
  • Fixed an issue related to the form authentication which prevents logout detection during attacking phase.
  • Fixed an Local File Inclusion (LFI) vulnerability detection issue when attacked with a FullUrl payload.
  • Fixed an incorrect retest result which occurs when the target website is not reachable.
  • Fixed a CSP vulnerability issue for deprecated CSP header name on meta tags.
Netsparker Cloud Update - 18th October 2016

New Features

New Web Security Checks

Improvements

  • Improved the Cross-site Scripting (XSS) vulnerability security checks coverage.
  • Renamed "Permanent XSS" vulnerability to "Stored XSS".
  • Added type ahead search functionality for Scan Policy > Security Checks.
  • Added HTTP methods to AJAX / XML HTTP Requests knowledge base section.
  • Optimized the performance of SOAP web service parsing by skipping the WSDLs that are already parsed.
  • Added Scan Policy > Crawling options to enable/disable parsing of SOAP and REST web services.
  • Improved DOM simulation by simulating "contextmenu" events.
  • Increased the default values for "Maximum Page Visit" and "Max. Number of Parameters to Attack on a Single Page" settings.
  • Improved XML parsing during crawling by parsing empty XML elements as parameters too.
  • Added the ability to attack parameter names.
  • Added a note to vulnerability detail for non-exploitable frame injection.
  • Added .jhtml and .jsp attacks to file upload engine.
  • Improved CORS security checks.
  • Improved Open Redirect engine to detect CNAME injection such as example.com.r87.com.
  • Improved XSS confirmation for vulnerabilities found inside noscript tags.
  • Added an attack pattern to the command injection engine to bypass whitespace filtering using $IFS environment variable.

Bug Fixes

  • Fixed a form authentication issue where the last form authentication sequence requests were prematurely cancelled.
  • Fixed an issue where incorrect PHP source code disclosures are reported for some binary responses.
  • Fixed the broken External Reference link on Remote Code Evaluation (PHP) vulnerability.
  • Fixed a file upload input DOM parsing issue which prevents some file upload attacks.
  • Fixed a form authentication issue occurs on web sites that opens popups during form authentication sequence.
  • Fixed a DOM simulation issue occurs when there is a form element with name "action" on target web page.
  • Fixed duplicate "Email Address Disclosure" reporting issue.
  • Fixed a NullReferenceException on occurs during CORS security checks.
  • Fixed a CSRF exploit generation issue where the generated file is empty.
  • Fixed an issue where XSS vulnerability is missed when multiple redirects occur.
  • Fixed a text parsing issue where relative URLs were not supported as base href values.
  • Fixed an issue where Missing X-Frame-Options Header vulnerability is reported even though ALLOW-FROM is included in the header.
  • Fixed an XSS attacking issue where duplicate attacks are made for same payload.
  • Fixed a Header Injection attack issue where first line of the HTTP request gets corrupted on full URL attacks.
  • Fixed an issue where post exploitation does not work sometimes.
  • Fixed a form authentication issue where any slash character in credentials cannot be used.
Netsparker Cloud Update - 21st September 2016

New Features

Improvements

Bug Fixes

  • Fixed wrong websites threat levels (they were just representing the last scan's threat level).
  • Fixed the security overview chart which was showing only the last scan's threat level for each website.
Netsparker Cloud Update - 30th June 2016

NEW FEATURES

NEW SECURITY CHECKS

  • Added Samesite cookie attribute check.
  • Added Reverse Tabnabbing check.
  • Added Subresource Integrity (SRI) Not Implemented check.
  • Added Subresource Integrity (SRI) Hash Invalid check.

IMPROVEMENTS

  • Various memory usage improvements to better handle large websites.
  • Improved vulnerability templates by adding product information when a 3rd party web application (WordPress, Drupal, Joomla, etc.) is discovered.
  • Improved DOM simulation by supporting HTTP responses that is translated to HTML web pages using XSLT.
  • Improved coverage of Local File Inclusion security check engine.
  • Improved the automatic form authentication script to click the "button" HTML elements if no suitable button is found.
  • Improved the "HTML Base Tag Hijacking" vulnerability template.
  • Improved the long-term memory usage of the DOM simulation and cross-site scripting (XSS) scanning.
  • DOM simulation smart filtering now prunes unnecessary DOM branches.
  • Improved the detection of "Redirect Body Too Large" vulnerability.

BUG FIXES

  • Fixed the "Cross-site Scripting via Remote File Inclusion" vulnerability, which was not being confirmed automatically.
  • Fixed the incorrect form value issue when the #DEFAULT# form value is removed.
  • Fixed an HTTP Archive Importer issue during which the POST method was parsed as GET when postData is empty.
  • Fixed a bug in which a GWT parameter that contained a Base64 encoded value was not detected.
  • Fixed a time span parsing bug in Knowledge base report templates.
  • Fixed an issue in which some vulnerabilities are treated as fixed while retesting.
  • Fixed an issue in which XSS proof URL was missing alert function call.
  • Fixed the broken "Generate Debug Info" function of JavaScript simulation feature.
  • Fixed a NullReferenceException that can be thrown by the Subresource integrity security checks.
  • Fixed cURL login sample in API documentation.