Vulnerability Management Web Scan Changelog

Sylwia · 2022-11-15T10:13:15+00:00

There was an error rendering this rich post.

This changelog provides updates for the Web Scan component of WithSecure™ Elements Vulnerability Management. It includes the latest improvements, fixes, and new features related to scanning and assessing the security of web applications and services, helping organizations identify vulnerabilities in their online assets.

For updates on other components such as the portal, discovery scan, system scan, or scan node agent, please refer to their respective changelogs.

Find more posts tagged with

Changelog

Comments

Arasz

Version 5.40.0 released February 19, 2024

New features and improvements:

[RADAR-26898] - Improved the XSS vulnerability plugin
[RADAR-26994] - Updated the engine to the latest dotnet version
[RADAR-25881] - Increased a scan time limit
[RADAR-26595] - Fixed issue with an exception message leakage not marked as a finding

Arasz

Version 5.39.0 released November 28, 2023

New features and improvements:

[RADAR-26319] - Updated headless crawler dependencies
- updated Chromium to the latest revision
- updated Puppeteer to the latest version
[RADAR-26450] - Fixed case of a false positive finding for missing CSRF token vulnerability
- added a new step to the CSRF token search algorithm

Arasz

Version 5.38.2 released November 06, 2023

New features and improvements:

[RADAR-26348] - Fixed a bug where a type action was unchecking checkbox during login

Arasz

Version 5.38.1 released October 17, 2023

New features and improvements:

[RADAR-26232] - Fixed a null reference exception

Arasz

Version 5.38.0 released October 16, 2023

New features and improvements:

[RADAR-26156] - Added detailed, step by step monitoring of authentication and redirection

Arasz

Version 5.37.0 released September 26, 2023

New features and improvements:

[RADAR-25838] - Improved authentication requests collection
[RADAR-26063] - Improved monitoring during authentication
[RADAR-26080] - Fixed reauthentication detection for redirection responses and improved cookie management
[RADAR-22690] - Replaced F-Secure company name to WithSecure in the chromium extension

Arasz

Version 5.36.0 released August 2, 2023

New features and improvements:

[RADAR-25711] - Added 502 HTTP response code to ignored response codes in blind difference SQLi vulnerability check to reduce false positives
[RADAR-25711] - Improved vulnerability check execution in cases where async execution was necessary
[RADAR-25722] - Fixed issue with a CSRF check execution where for some cases execution finished response was not sent and a scan never reached normal ending conditions

Arasz

Version 5.35.0 released July 28, 2023

New features and improvements:

[RADAR-25683] - Fixed issue with a CSRF check execution where CSRF check state counters were not managed properly and a scan never reached normal ending conditions
[RADAR-25683] - Improved a scan performance monitoring

Arasz

Version 5.34.1 released July 14, 2023

New features and improvements:

[RADAR-25630] - Fixed issue with a null reference exception during report creation for some vulnerability checks

Arasz

Version 5.34.0 released July 13, 2023

New features and improvements:

[RADAR-25516] - Fixed issue with case sensitive HTTP headers
[RADAR-25587] - Fixed issue with a report size limit errors when limit was not reached

Arasz

Version 5.33.0 released July 07, 2023

New features and improvements:

[RADAR-25403] - Fixed issue with the incorrectly displayed discovered pages

Arasz

Version 5.32.0 released July 05, 2023

New features and improvements:

[RADAR-25487] - Added Chromium dependencies for supported Linux distributions

Arasz

Version 5.31.1 released June 05, 2023

New features and improvements:

[RADAR-25427] - Changed Chromium for Windows version to the last version with support for Windows server 2012 r2

Arasz

Version 5.31.0 released May 17, 2023

New features and improvements:

[RADAR-25108] - Updated included Chromium to the newest revision
- Improved update process

Arasz

Version 5.30.0 released April 20, 2023

New features and improvements:

[RADAR-24832] - Fixed issue with the variable query parameters in the recorded login fingerprint URL
[RADAR-23881] - Improved consistency between scan executions by moving reported vulnerabilities selection at the end of the scan

Arasz

Version 5.29.0 released March 01, 2023

New features and improvements:

[RADAR-24788] - Fixed null reference exception in the headless browser HTTP request interceptor
[RADAR-24730] - Fixed an error "element.href.startsWith is not a function" in the headless browser interop code
[RADAR-24737] - Added logout monitoring to the regular crawler

Arasz

Version 5.28.0 released February 14, 2023

New features and improvements:

[RADAR-24023] - Added 401 Unauthorized response code as a correct return code for the login page
[RADAR-24401] - Added support for the CVSSv3
[RADAR-24450] - Fixed unhandled exception in the headless crawler
[RADAR-24503] - Fixed issue with a disappearing recording state between page changes in the Web Scan Recorder Chrome extension (version 2.4.0)
[RADAR-24583] - Fixed issue with not intercepted responses headers during authorization

Arasz

Version 5.27.0 released January 18, 2023

New features and improvements:

[RADAR-24395] - Fixed issue with a failing scan when recording didn't have any requests
[RADAR-23894] - Updated User-Agent header used by the scanner
[RADAR-24225] - Reduced vulnerability checking load on the target when crawling is active

Arasz

Old change logs

Publication time frame: October 2022 - November 2022

Version 5.24.0 released October 6, 2022

New features and improvements:

[RADAR-23624] - Updated a User-Agent header used by the scanner
- User-Agent header contains a current version of the scanner

Version 5.25.0 released October 24, 2022

New features and improvements:

[RADAR-23753] - Improved a login fingerprint search algorithm
[RADAR-23756] - Added a size limit to the HTTP response cache file
[RADAR-23704] - Improved a build result observability and fixed unstable unit tests

Version 5.26.0 released November 03, 2022

New features and improvements:

[RADAR-23828] - Fixed issue with an unhandled logout during a scan in rare cases
- Improved logout detection and reauthentication algorithm in general
[RADAR-23781] - Added an experimental ARM64 build target

Sylwia

Old change logs

Publication time frame: March 2022 - September 2022

Version 5.18.0 released March 09, 2022

New features and improvements:

[RADAR-21508] - Added Log4Shell vulnerability check
[RADAR-21654] - Fixed issue with a scan that takes more than 24 hours when the target has multiple pages with the same form
[RADAR-21794] - Fixed issue with a failed Web Scan recording replay in some cases
[RADAR-21829] - Fixed issue with enabled plugins defined in a template not inherited by a scan configuration

Version 5.19.0 released March 31, 2022

New features and improvements:

[RADAR-20855] - Changed an HTTP connection implementation. New implementation is based on HTTP Client.
[RADAR-22177] - Updated .NET framework version to .NET 6 (LTS)
[RADAR-22181] - Updated build definition to use a new build node

Version 5.20.1 released May 16, 2022

New features and improvements:

[RADAR-22051] - Fixed issue with a headless crawler throwing exception when a response contains compress content encoding
[RADAR-22403] - Fixed issue with a headless crawler blocked by a website allow notifications popup
[RADAR-22230] - Updated build definition to use a Linux build node

Version 5.21.0 released June 28, 2022

New features and improvements:

[RADAR-20980] - Improved authentication with redirections handling
- Introduced an additional external URL access configuration option. This addresses the case of an SPA target with a complicated API (lots of different URLs) and external authentication provider (URLs with unique session/request query parameters).
- Added Login Fingerprint URL to the recording. This will allow for redirection from the target URL specified in the scan configuration as a start URL to the fingerprint URL (URL where the target lands after an authentication process).
- Changed the way how HTTP requests are intercepted by the headless crawler and replaced an HTTP request execution backend. Those changes extend our support of HTTP versions to any version supported by the .NET framework and the browser. HTTP 2 pages are fully supported now.
[RADAR-22693] - Improved headless crawler
- Changed the finish conditions for the headless crawler
- Improved the new page URL reporting. Crawler will report each new address bar URL (same document navigation)
[RADAR-22600] - Added a minor version update after hotfix/bugfix
[RADAR-22542] - Improved HTTP request and response model
- Internal change: the internal HTTP model was refactored and prepared for the next improvements to the headless crawler.
[RADAR-18909] - Added an additional method for identifying elements in a recording
- Added XPath as an additional ID for a recorded element (CSS selector is treated as a main ID).

Version 5.21.1 released July 28, 2022

New features and improvements:

[RADAR-23046] - Fixed issue with a headless crawler crashing when trying to open an external page in a new tab

Version 5.22.4 released September 05, 2022

New features and improvements:

[RADAR-23205] - Improved Time Based Blind SQLi implementation
- Algorithm is more robust and conditions for accepting vulnerability are hardened
[RADAR-23088] - Fixed an issue in which the scanner automatically logged out in some cases
[RADAR-23318] - Changed timeout handling during authentication
- Fixed an issue in which a scanned target took long to load or made a lot of requests during the authentication process and triggered timeout
[RADAR-18472] - Improved cookies handling
[RADAR-19124] - Updated dependencies
[RADAR-23375] - Changed the main identifier for web page elements in Headless Crawler to XPath
- Fixed an issue in which the CSS identifier was changing or was not unique

Version 5.23.0 released September 16, 2022

New features and improvements:

[RADAR-23471] - Added recording of logout actions to the Web Scan Recorder plugin
- In addition to blocking logout URLs, the scanner will block actions performed during the logout process

Version 5.23.1 released September 22, 2022

New features and improvements:

[RADAR-23562] - Fixed an issue with the Cookie manager throwing exceptions in some rare cases

Sylwia

Old change logs

Publication time frame: April 2021 - February 2022

Version 5.5.2 released April 07, 2021

New features and improvements:

[RADAR-19705] - Added handling for cases where the content encoding header is set to identity

Version 5.5.3 released April 26, 2021

New features and improvements:

[RADAR-19841] - Added a failproof HTTP response parser to parse HTTP responses without reason phrases

Version 5.6.0 released April 29, 2021

New features and improvements:

[RADAR-19737] - Limited plugins access to URLs marked as a JS file
[RADAR-18639] - Changed the callback URL for XSS attack
[RADAR-18908] - Added an option to allow requests to a domain different from the target domain
[RADAR-19740] - Improved the CSRF token search in the case of a known token

Version 5.7.0 released June 15, 2021

New features and improvements:

[RADAR-19757] - Updated .NET framework version to .NET 5
[RADAR-19958] - Replaced insecure binary formatter
[RADAR-19959] - Replaced obsolete SSL configuration values
[RADAR-20005] - Updated Puppeteer and Chromium to the newest version
[RADAR-20023] - Improved difference-based SQLi plugin

Version 5.7.1 released June 17, 2021

Fixed issues:

[RADAR-20289] - Restored the previously used Chromium version (dependency problem on Linux)

Version 5.8.0 released July 13, 2021

New features and improvements:

[RADAR-20336] - Changed a NuGet source

Version 5.9.0 released August 09, 2021

New features and improvements:

[RADAR-19670] - Improved headless crawler
[RADAR-20007] - Fixed Web Scan Web Console
[RADAR-20495] - Improved difference-based SQLi algorithm
[RADAR-20587] - Allowed requests to ReCaptcha API

Version 5.10.0 released August 30, 2021

New features and improvements:

[RADAR-19465] - Improved Web Scan RAM usage

Version 5.10.1 released September 13, 2021

New features and improvements:

[RADAR-20831] - Fixed the issue with calling ToString on an empty page state

Version 5.11.0 released September 18, 2021

New features and improvements:

[RADAR-20793] - Added HTTP response splitting check
[RADAR-20797] - Improved difference-based SQLi check, ignored 429 response code, and changed the reporting conditions for a 5xx response code.

Version 5.12.0 released September 30, 2021

New features and improvements:

[RADAR-20387] - A customized OpenSSL library is used on Linux
[RADAR-20912] - Enabled changing the follow redirects option by configuration
[RADAR-20926] - Handling of a login fingerprint check on frame-based sites

Version 5.13.0 released October 13, 2021

New features and improvements:

[RADAR-20525] - Extended an SPA attack surface
[RADAR-20801] - Added additional health checks

Version 5.14.0 released November 04, 2021

New features and improvements:

[RADAR-21068] - Headless crawler improvements

Version 5.15.0 released November 25, 2021

New features and improvements:

[RADAR-21110] - Added additional field to a scan report

Version 5.16.0 released January 11, 2022

New features and improvements:

[RADAR-20461] - Scanner accepts and handles a scan configuration with checks selected by a user
[RADAR-21346] - Added new HTTP header checks (x-content-type, x-powered-by, missing SameSite cookie attribute)
[RADAR-21392] - Added a size limit for a scan report
[RADAR-21436] - Fixed issue with a null reference in some rare cases during scanner start

Version 5.17.0 released February 01, 2022

New features and improvements:

[RADAR-21637] - Limited number of analyzers to run on requests to external JS resources
[RADAR-21677] - Fixed issue with not persistent Run Attack option in the scan configurator

Version 5.17.1 released February 15, 2022

New features and improvements:

[RADAR-21907] - Fixed issue with a hostname resolved to IPv6 instead of an IPv4

Sylwia

Old change logs

Publication time frame: November 2020 - March 2021

Version 5.0.0 released November 24, 2020

New features and improvements:

[RADAR-17349] - Clustering mechanism reimplemented
[RADAR-15138] - New checker for Cross-Site Request Forgery detection
[RADAR-18471] - Improved detection of vulnerable Bootstrap library
[RADAR-18371] - Solution reorganization and code cleanup (no visible impact for end users)
[RADAR-18290] - Improvements in Difference-based SQL injection checker

Fixed issues:

[RADAR-18596] - Fixed issue with healthcare mechanism
[RADAR-18606] - Fixed issue with reading a recording containing illegal characters

Version 5.0.1 released November 25, 2020

Fixed issues:

[RADAR-18734] - Fixed issue with unlimited length of form's AffectedName field

Version 5.0.2 released November 25, 2020

Fixed issues:

[RADAR-18745] - Fixed issue with authentication from a recording

Version 5.0.3 released November 25, 2020

Fixed issues:

[RADAR-18758] - Fixed issue with scan getting terminated when manual crawling action can't be replayed

Version 5.0.4 released November 30, 2020

Fixed issues:

[RADAR-18763] - Fixed issue with omitted logic that marks some form parameters as not being attackable when the form comes from a headless crawler
[RADAR-18771] - Fixed issue with too long <issueDetails> elements in an XML report

Version 5.0.5 released December 2, 2020

Fixed issues:

[RADAR-18796] - Fixed issue with System. InvalidOperationException raised by some checkers

Version 5.0.6 released December 3, 2020

Fixed issues:

[RADAR-18795] - Fixed issue with false positive findings reported by cross-site request forgery plugin

Version 5.1.0 released December 22, 2020

New features and improvements:

[RADAR-18618] - Fixed a problem with finding formatted payload in difference-based SQLi plugin
[RADAR-18777] - Cleaned up the HTTP exchange API
Improvements in DNS resolver and recheck process

Version 5.1.1 released December 22, 2020

Fixed issues:

[RADAR-18939] - Fixed chaining sequence for SQLi plugins

Version 5.2.0 released January 11, 2021

New features and improvements:

[RADAR-18920] - Add crawling restrictions for JS src urls
[RADAR-18944] - Difference-based SQLi - ignore changing content in HTML comments
[RADAR-19061] - Difference-based SQLi - ignore similar differences
[RADAR-19062] - Difference-based SQLi - ignore broken responses

Version 5.3.0 released January 21, 2021

New features and improvements:

[RADAR-19107] - Make finding the description from the difference-based blind SQLi plugin more human friendly
[RADAR-19080] - Improve selectors generated by Recorder

Version 5.4.0 released February 01, 2021

New features and improvements:

[RADAR-19194] - Ignore mailchimp plugin form fields
[RADAR-19176] - Scanned page source code in the crawled URL fixed

Version 5.5.0 released March 23, 2021

New features and improvements:

[RADAR-19382] - Improved HTTP response reading and parsing

Version 5.5.1 released March 29, 2021

New features and improvements:

[RADAR-19657] - Fixed issue with duplicated request id in clustering

Sylwia

Old change logs

Publication time frame: April 2020 - October 2020

Version 4.4.0 released April 3, 2020

New features and improvements:

[RADAR-16593] - Handling mouse-over type of events in a recording

Fixed issues:

[RADAR-16591] - Fixed issue with replaying a recording 'change' event when the input's selector had changed during typing

Version 4.4.1 released April 9, 2020

Fixed issues:

[RADAR-16706] - Fixed issue with broken basic authentication in classical crawler
[RADAR-16740] - Fixed issue with not executing some Forceful Browsers' checks when only this kind of checks are configured

Version 4.4.2 released April 9, 2020

Fixed issues:

[RADAR-16769] - Fixed issue with a timeout during the approachability check

Version 4.4.3 released May 19, 2020

New features and improvements:

[RADAR-16922] - Upgraded Chromium to rev. 722234 (ver. 80.0.3987.0)

Version 4.4.4 released May 20, 2020

New features and improvements:

[RADAR-17081] - Fixed issue with launching Chromium

Version 4.4.5 released May 21, 2020

New features and improvements:

[RADAR-17057] - Applied a workaround to enable finding the element with changing CSS selector when replaying authentication flow

Version 4.5.0 released June 18, 2020

New features and improvements:

[RADAR-16286] - Follow redirects option in engine (turned off by default)

Fixed issues:

[RADAR-17029] - Fixed issue with Chromium orphans left after scan
[RADAR-17279] - Fixed issue with handling the first POST request after successful authentication
[RADAR-17306] - LoginFingerprint and LogoutFingerprint in WebScan config override recorded values
[RADAR-17165] - Fixed issue with false positives caused by prefixing payloads in forceful browsing checks

Version 4.5.1 released June 23, 2020

Fixed issues:

[RADAR-17279] - Fixed issue with starting URLs not being added to the blocklist
[RADAR-17368] - Fixed issue with not respecting HTTP method restrictions for a POST request to start crawling

Version 4.5.2 released June 25, 2020

Fixed issues:

[RADAR-17279] - Fixed issue with replaying events when starting request is POST

Version 4.6.0 released July 1, 2020

Fixed issues:

[RADAR-17460] - Fixed issue with hanging scan if the target responds with JSON content type
[RADAR-17450] - Fixed error in log entry informing about redirection

Version 4.6.1 released July 2, 2020

Fixed issues:

[RADAR-17279] - Fixed issue with improper starting URL for crawling
[RADAR-17506] - Fixed issue with hanging headless crawler on print dialog

Version 4.6.2 released July 8, 2020

Fixed issues:

[RADAR-17557] - Fixed issue with input field not being cleared before typing in the headless crawler
[RADAR-17558] - Fixed issue with handling navigation when replaying manual crawling

Version 4.7.0 released July 29, 2020

New features and improvements:

[RADAR-1054] - Handling HTML forms protected by one-time anti-CSRF token

Version 4.7.1 released August 19, 2020

Fixed issues:

[RADAR-17811] - Fixed issue with approachability phase failure

Version 4.7.2 released August 20, 2020

Fixed issues:

[RADAR-17826] - Fixed issue with starting request being restricted via HTTP method restriction

Version 4.7.3 released August 20, 2020

Fixed issues:

[RADAR-17851] - Fixed issue with proper selection of starting request

Version 4.7.4 released August 26, 2020

Fixed issues:

[RADAR-17866] - Fixed issue with improper handling of CRLF (end of line) in LoginFingerprint

Version 4.7.5 released September 19, 2020

Fixed issues:

[RADAR-18010] - Fixed issue with redirection made by Javascript code in a browser
[RADAR-18102] - Fixed issue with race condition while reading the recording file

Version 4.7.6 released October 16, 2020

Fixed issues:

[RADAR-18379] - Fixed issue with basic authentication

Version 4.8.0 released October 20, 2020

New features and improvements:

[RADAR-18312] - Configuration settings and handling cleaned up
[RADAR-9211] - NTLM authentication implemented
[RADAR-18244] - Added HTTP header "Accept-Encoding: gzip, deflate" to default headers
[RADAR-17986] - Configurable query parameters that are distinguishable for the crawler
[RADAR-18004] - Build directory does not contain Chromium revision number
Some internal changes with no visible impact for end users

Sylwia

Old change logs

Publication time frame: November 2019 - March 2020

Version 4.1.10 released November 07, 2019

Fixed issues:

[RADAR-15277] - Fixed issue with trying to use a non-visible DOM element during authentication

Version 4.1.11 released November 12, 2019

Fixed issues:

[RADAR-15303] - Fixed issue with an unhandled exception during the reporting phase

Version 4.1.13 released November 21, 2019

Fixed issues:

[RADAR-15381] - Added 'input[type=image]' to queried selectors when searching the submit button of the login form
Fixed issue with broken links extraction in the headless crawler

Version 4.1.14 released December 10, 2019

Fixed issues:

[RADAR-15493] - Applied a workaround for an issue relating to blocking the permanent connections (e.g. "polling")

Version 4.1.15 released December 11, 2019

Fixed issues:

[RADAR-15491] - Fixed issue with looking for the LoginFingerprint when a page wasn't fully loaded
[RADAR-15478] - Skipping duplicate (not visible) inputs when typing credentials in a login form

Version 4.1.16 released December 13, 2019

Fixed issues:

[RADAR-15602] - Fixed issue with proper decoding form parameters created from a request body
[RADAR-15544] - Fixed broken payload in BlindCMDi plugin
[RADAR-15493] - Fixed problem with timing out requests during approachability checking

Version 4.2.0 released January 9, 2020

New features and improvements:

[RADAR-14445] - Replaying new recording format (from new recorder Chrome plugin)
[RADAR-14185] - Improved some payloads of SQL injection attacks
[RADAR-14185] - Upgraded all acceptance tests to a new format, added many new tests
[RADAR-15741] - Optimized the headless crawler starting mechanism

Fixed issues:

[RADAR-15679] - Fixed issue with missing forceful browsers' findings
[RADAR-14185] - Fixed issue with SOAP requests missed by the crawler
[RADAR-15602] - Reauthentication check skips looking for logout fingerprint in javascript files

Version 4.2.1 released January 21, 2020

Fixed issues:

[RADAR-15602] - Fixed issue with blocking initial request

Version 4.2.2 released January 29, 2020

Fixed issues:

[RADAR-15995] - Relaxed the conditions for a 'good' health testing response

Version 4.2.3 released February 02, 2020

Fixed issues:

[RADAR-15995] - Fixed "NullReferenceException" issue

Version 4.2.4 released February 10, 2020

Fixed issues:

[RADAR-16087] - Fixed issue with unnecessary scan termination on headless browser closing timeout

Version 4.2.5 released February 13, 2020

New features and improvements:

[RADAR-15995] - Some performance optimization of disk data storage (caching component)

Fixed issues:

[RADAR-15995] - Fixed issue with XSS payload serialization, fixed issue with memory statistics not showing in the log file

Version 4.2.6 released February 26, 2020

New features and improvements:

[RADAR-15995] - Performance optimization - response body is cached/stored separately from exchange data
[RADAR-15995] - Performance optimization - handling the logic of the PrivateIpAddressDisclosure plugin
Other minor performance optimizations

Fixed issues:

[RADAR-15995] - Fixed problem with memory leak caused by specific component registration in application container
[RADAR-15995] - Fixed problem with counting memory size of disk's cache structure

Version 4.2.7 released March 13, 2020

Fixed issues:

[RADAR-16396] - Fixed problem with negative index when generating finding info in the log file

Version 4.3.0 released March 31, 2020

New features and improvements:

[RADAR-16429] - Handling a new configuration format produced by improved WebScan's configuration wizard in the Radar
[RADAR-16435] - Crawled (and attacked) request can be filtered out by HTTP methods

Fixed issues:

[RADAR-16517] - Fixed dates in WebScan's report
[RADAR-16516] - fixed issue with NetworkInformationException

Sylwia

Old change logs

Publication time frame: August 2019 - October 2019

Version 3.2.1 released August 21, 2019

Fixed issues:

[RADAR-14484] - Fixed an issue with authenticated scans of WordPress sites. Fixed the handling of the logout fingerprint, it is treated as a regular expression by default but some values cannot be parsed as a correct regular expression, in which case it is treated as simple text. Fixed the progress percent info showing NaN in some rare cases.

Version 3.3.0 released August 23, 2019

New features and improvements:

[RADAR-14280] - Attacking JSON payloads (error-based SQLi so far)
[RADAR-14445] - Replaying recorded DOM events by the headless crawler (feature not available for the user)

Fixed issues:

[RADAR-14578] - Removed "faultstring" SQLi fingerprint that causes false-positive findings
[RADAR-14568] - Fixed the "login form's 'submit' button hasn't been found" issue - a form's button without the 'type' attribute is recognized as a 'submit' button (in accordance with HTML spec)
[RADAR-14388] - Another fix related to proper scan termination in case of an exception inside headless crawler

Version 3.3.1 released August 28, 2019

Fixed issues:

[RADAR-14602] - Fixed OverflowException during report generation

Version 3.4.0 released September 9, 2019

New features and improvements:

[RADAR-14280] - Attacking JSON payloads (all but XSS attack types)
[RADAR-1209] - New plugin (id 59) that looks for old, vulnerable javascript libraries
[RADAR-13319] - Added references to OWASP Top 10 categories in all plugins (not visible for the user so far)

Version 3.4.1 released September 16, 2019

Fixed issues:

[RADAR-14773] - WebSocket's 'upgrade' requests are blocked (they hang the crawler)

Version 3.4.2 released September 19, 2019

Fixed issues:

[RADAR-14773] - Another fix related to WebSocket's 'upgrade' mechanism

Version 3.4.3 released September 20, 2019

Fixed issues:

[RADAR-14804] - Fixed issue with visibility of HTTP requests on reports

Version 3.4.4 released September 26, 2019

Fixed issues:

[RADAR-14876] - Fixed issue with attacking external hosted js libs

Version 4.0.0 released October 2, 2019

New features and improvements:

Attacking model redesigned and reimplemented:
- attackers are defined in a declarative way
- logic of popular types of attacks is abstracted and centralized
- attackers can reuse results of other attackers
- identifiers of all plugins have changed
- "GET parameter" affected element name renamed to "query parameter", and "POST parameter" renamed to "form parameter"

Version 4.0.1 released October 2, 2019

Fixed issues:

[RADAR-14914] - Fixed issue with not applying HTTP headers from config by Headless crawler

Version 4.0.2 released October 4, 2019

Fixed issues:

[RADAR-14941] - Increased the headless browser's timeout for the approachability checking phase

Version 4.0.3 released October 7, 2019

Fixed issues:

[RADAR-14953] - Fixed issue with conflicts in javascript events registration during the authentication phase

Version 4.0.4 released October 9, 2019

Fixed issues:

[RADAR-14941] - Fixed issue with reporting outer javascript links as discovered pages

Version 4.0.5 released October 14, 2019

Fixed issues:

[RADAR-15049] - Fixed issue with NullReferenceException when rechecking JSON findings

Version 4.1.0 released October 16, 2019

New features and improvements:

[RADAR-14987] - New attacker - difference-based SQL injection
[RADAR-15036] - Error-based SQL injection attacks XML element injection point
[RADAR-13319] - XML final report contains findings' OWASP references
[RADAR-14805] - Improvements in the logic of time-based attacks

Fixed issues:

[RADAR-15059] - Fixed issue with false positives generated by BackupDirectories forceful browser
[RADAR-14909] - Fixed issue with hanging scans in case of OutOfMemoryException in starting phase

Version 4.1.1 released October 17, 2019

Fixed issues:

[RADAR-15090] - Fixed issue with finding the proper submit button within the authentication form

Version 4.1.2 released October 17, 2019

Fixed issues:

[RADAR-15097] - Fixed issue with scanning all URLs configured in "Add relative URLs for scanning"

Version 4.1.4 released October 21, 2019

Fixed issues:

[RADAR-14467] - Fixed issue with proper scan termination in case of exception of initial scan phase
[RADAR-15129] - Fixed issue with the termination of the scan by not handling requests with JSON-array payload

Version 4.1.5 released October 24, 2019

Fixed issues:

[RADAR-15159] - When authenticating, WebScan chooses the submit button if there are other non-button submit controls
[RADAR-15164] - WebScan returns a specific exit code when generating a report fails

Version 4.1.6 released October 25, 2019

Fixed issues:

[RADAR-15159] - Fixed issue with dialogs blocking authentication flow

Sylwia

Old change logs

Publication time frame: January 2019 - July 2019

Version 2.23.0 released January 2, 2019

New features and improvements:

Better progress reporting
Centralized and unified logging of the internal state of various components (at DEBUG level)
Many technical changes to make the solution ready for a headless crawler component (RADAR-12146, RADAR-11617)

Version 2.23.1 released January 7, 2019

Fixed issues:

Response encoding is set to UTF-8 when it cannot be deduced from the Content-Type header (RADAR-12246)

Version 2.23.2 released January 14, 2019

Fixed issues:

XML report sent is now UTF-8 encoded (RADAR-12246)

Version 2.23.3 released January 16, 2019

Fixed issues:

Fixed stopping the scan when the global timeout is reached (RADAR-12425)

Version 2.23.4 released February 15, 2019

Bumped version to avoid warnings about an engine not being updated in Radar Security Center (RADAR-12581)

Version 2.24.0 released March 1, 2019

Fixed issues:

[RADAR-12789] - Fixed problems with memory overuse
[RADAR-12719] - Fixed issue manifesting with "An item with the same key has already been added." error log
[RADAR-12861] - Fixed issue with inappropriate extraction of links from 'window.open' javascript code
[RADAR-12795] - The "~1" check in forceful browsing plugins was discarded as it leads to false positives
[RADAR-12796] - Login bypass type of the SQL injection check was discarded as it leads to false positives

Version 2.24.1 released March 4, 2019

Fixed issues:

[RADAR-12892] - Fixed issue with forms authentication where a parameter name of a login form had to be encoded.

Version 2.25.0 released March 10, 2019

New features and improvements:

[RADAR-12892] - Improvements related to memory overuse.

Version 2.25.1 released March 11, 2019

Fixed issues:

[RADAR-12948] - Fixed path encoding inside URLs.

Version 2.25.2 released March 13, 2019

Fixed issues:

[RADAR-12892] - Further improvements related to memory overuse.

Improvements:

[RADAR-12976] - Improved logging of crawled pages
[RADAR-12972] - Multipart request should not decode the param values

Version 3.0.0 released July 17, 2019

New features and improvements:

[RADAR-11238] - Porting WebScan to .NET Core - can be run on Linux (also RADAR-6979)
[RADAR-10783] - Headless crawler in WebScan
- a new Chromium-based crawler is added to support the existing one
- the new crawler runs for a configurable time (now set to 3 minutes), looks for links, forms, and events in the rendered DOM, and captures AJAX requests
- the approachability check (with authentication) phase is done by the new crawler
[RADAR-13757] - New building pipeline incorporating new requirements (.NET Core, downloading Chromium binaries, etc.)
[RADAR-10211] - Added static backup guesses (.zip, .tar.gz, .tgz) to BackupDirectories and BackupFiles forceful browsing plugins
[RADAR-11324] - Added a common folder (.idea, .vs, .vscode) to the CommonDirectories forceful browsing plugin
[RADAR-13843] - Cookies specified in scan config always override ones obtained during the scan
[RADAR-13869] - Clusterer's limit of checked samples in a cluster was decreased to 100
[RADAR-13880] - Added a new scope restriction that is based on URL path depth (number of path segments)
[RADAR-13919] - Added a new scope restriction that is based on the detection of recurring URL path segments (detection of looped paths)
[RADAR-10365] - XSS attacks that execute remote JS script uses now real resources (JS script) that actually exploit (and confirm) the vulnerability

Fixed issues:

[RADAR-13797] - Form has the wrong URL when it has a relative URL in the 'action' attribute
[RADAR-11556] - Static analysis of external responses within checking approachability phase is forbidden
[RADAR-13869] - Forcing to stop scan when "max. URLs to crawl" limit was reached
[RADAR-13965] - Web Scan cuts to big request body (not only response body) for a report
[RADAR-14012] - Fixed an issue with incorrect URL in _Findings_ field shown by forceful browsing plugins

Version 3.1.0 released July 22, 2019

New features and improvements:

[RADAR-869] - Grouping plugins to mitigate duplicated findings (e.g. time-based SQLi are executed only if error-based attacks fail)
[RADAR-9992] - New static analyzer: Missing 'X-Frame-Options' header
[RADAR-13995] - Fixed problem with disk storage overuse due to the accumulation of unprocessed responses
[RADAR-14148] - Build artifacts includes the xlsx sheet containing known vulnerabilities of well known broken web applications generated from test cases

Fixed issues:

[RADAR-14125] - Excluded range 127/8 from the False positive: internal IP address disclosure PrivateIpAddressDisclosure plugin
[RADAR-14268] - Fixed a bug within checking XSS fingerprint's procedure that produced false positives in some specific cases

Version 3.2.0 released July 30, 2019

New features and improvements:

[RADAR-12883] - Removing unwanted findings by forceful browsers
[RADAR-14399] - Headless crawler improved to minimize breaking connections because of moving on too fast
[RADAR-14388] - Memory usage optimizations

Fixed issues:

[RADAR-14324]- Fixed issue related to missing some intermediate paths by the crawler
[RADAR-14367] - Fixed issue with reporting proper URL by static analyzers if they report only single finding
[RADAR-14371] - Fixed issue with wrong Content-Length header value for POST request mapped from headless crawler
[RADAR-14372] - Fixed issue with wrong Content-Length header value for some POST attack requests
[RADAR-869] - Fixed issue with breaking scans when a plugin's grouping mechanism received requests other than GET or POST
[RADAR-14388] - Fixed terminating the scan in case of MemoryException

Sylwia

Old change logs

Publication time frame: August 2018 - December 2018

Version 2.17.0 released August 14, 2018

New features and improvements:

Connections management (RADAR-10978)
- Engine switched to sending HTTP/1.1 requests by default
- Support for the Connection: Keep-Alive http header
- Dropping connections that cannot be reused for some reason
Detection of blocked symbols in query parameter values in URLs (turned off by default for now) (RADAR-11116)
Request rerun provides info about the rerun reason in the log file

Version 2.17.1 released August 14, 2018

Fixed issues:

Blocked attacks against URLs returning 30x when some fingerprint is then searched (RADAR-11114)
Fixed "This operation is not supported" issue on gzip-compressed responses

Version 2.17.2 released August 16, 2018

New features and improvements:

Requests other than GET or POST in recording are filtered out instead of the exception being thrown (RADAR-10868)

Version 2.17.3 released August 22, 2018

New features and improvements:

The IP of the scanned host is now clearly visible at the start of the scan log - keyword: "TargetIp" (RADAR-11183)

Version 2.17.4 released August 25, 2018

Fixed issues:

Fixed handling of forms that have empty method attributes (RADAR-11184)

Version 2.18.0 released September 3, 2018

New features and improvements:

Additional scan phase for rechecking time-based findings (RADAR-11134)
- All findings of plugins 4, 7, 19, 29, and 32 are rechecked sequentially without any other traffic
- Findings rechecked negatively are removed
- Scan log contains information about what findings were rechecked and the result of the recheck

Version 2.18.1 released September 11, 2018

Fixed issues:

Fixed issue with proper scans finishing when the global timeout was reached (RADAR-11311)
The 99% scan progress indication is presented during the recheck phase

Version 2.19.0 released September 26, 2018

New features and improvements:

Technical changes that move the web scan functionality towards Linux compatibility (RADAR-6979)

Version 2.20.0 released October 16, 2018

New features and improvements:

Removed transformation of POST request into GET request (RADAR-11624)
"Duplicate" requests (the same query parameters but different values) found by the crawler are filtered out from attacks (RADAR-11638)
Many technical changes to improve the maintainability of the scanning engine (RADAR-11462, RADAR-11610)

Version 2.21.0 released October 30, 2018

New features and improvements:

Reduced the number of generated requests (RADAR-11626, RADAR-11627, RADAR-11742, RADAR-11625)
The fields in submitted forms are filled in with reasonable values if they are empty (RADAR-11688)
Crawler looks for links inside 'data-href' attributes (RADAR-11740)

Version 2.21.1 released November 19, 2018

Fixed issues:

Fixed issue with the wrong extraction of windows.location-type links inside HTML attributes (RADAR-11939)

Version 2.22.1 released December 7, 2018

New features and improvements:

Disk storage optimizations (RADAR-12133, RADAR-11793)

Version 2.22.2 released December 11, 2018

Fixed issues:

Handling improper values of the Content-Type header (RADAR-12120)

Sylwia

Old change logs

Publication time frame: May 2018 - July 2018

Version 2.11.0, released May 8, 2018

New features and improvements:

As a part of the vulnerability report data, Web Scan engine saves the HTML body of the page on which the vulnerability was found. The whole page has been recorded. After applying a change, only the surroundings of the found fingerprint is recorded and sent back to Radar Security Center. This limits the report size and optimizes data processing.

Fixed issues:

Fixed "System. ArgumentOutOfRangeException" issue related to plugin 44 (v2.10.2 does not cover all cases)
Removed duplication of payloads of the plugin 17

Version 2.11.1, released May 14, 2018

New features and improvements:

Changed the scan progress calculation to better reflect the scan state
Some optimizations in healthcheck mechanism

Fixed issues:

Fixed issue with hanging scans
Added additional logging info in case of problems with parsing html forms

Version 2.11.2, released May 16, 2018

Fixed issues:

Fixed the "Invalid URI: The Uri string is too long" issue

Version 2.11.3, released May 29, 2018

Fixed issues:

Fixed the "Index and length must refer to a location within the string" issue in XSS checks

Version 2.11.4, released June 1, 2018

New features and improvements:

All hidden fields within authorization requests inside recordings are replaced by values from a fresh request (there is no need to remove them from the recording file)

Fixed issues:

Checking request restrictions during authentication has been turned off (solves the issue when logout and login URLs are the same)
The Solution field in PostFileInclusion plugin has been supplemented

Version 2.11.5, released June 5, 2018

Fixed issues:

Pages that are problematic for the page clusterer are treated as unique (non-clustered) (RADAR-10206)

Version 2.12.0, released June 8, 2018

New features and improvements:

Finding's execution paths In Finding field were changed to more meaningful (RADAR-10591)
Changed the logic detection of the PrivateIpAddressDisclosure plugin (20) to minimize false positives (RADAR-10503)
Log events (messages, log levels) were rewieved and unified (RADAR-10382)
Added a second, JSON-structured log file for data processing and analysis (RADAR-10383)
Optimized the distribution of jobs related to processing requests and decreased the number of parallel processing threads (RADAR-10467)

Fixed issues:

All timed out and response code 500 requests are rerun by the engine (some such requests were lost when the target site had some problems with processing requests) (RADAR-10668)

Version 2.13.0, released June 19, 2018

New features and improvements:

Authentication mechanism rewritten to handle non-trivial cases (RADAR-10689)

Fixed issues:

Extracting forms mechanism ignores form tags inside HTML comments
Extracted form fields have properly encoded names

Version 2.13.1, released June 21, 2018

Fixed issues:

Scan terminates properly if the auth configuration is inconsistent (RADAR-10690)

Version 2.14.0, released June 26, 2018

New features and improvements:

New -i option for WSNG.exe that displays plugin information and vulnerability check statistics (RADAR-10662)
Memory usage optimizations (RADAR-10816)

Version 2.15.0, released July 13, 2018

New features and improvements:

Scan log file is UTF-8 encoded now (RADAR-10885)
XSS checker detects XSS reflected as html attribute name (RADAR-7131)
Crawling engine looks for links inside "windows.href=..." and "windows.open(...)" patterns
Some code refactoring to clean up the code base (restriction checking, recording handling) (RADAR-6976, RADAR-10943)

Fixed issues:

Engine components are disposed properly (RADAR-9384)
- Removed noisy warning/error messages at the end of the scan log file
Authentication flow skips all-hidden-fields forms when it looks for a login form

Version 2.16.1, released July 27, 2018

New features and improvements:

Improved load balancing and health check mechanisms (RADAR-10869)
Added information to logs about header/cookie injections
Limited the number of requests generated from http forms with radio button/checkbox input (RADAR-10976)
Plugin 41 (Cacheable HTTPS response) does not report findings for permanent redirections (RADAR-10990)
XSS in-attribute-name onerror-payload is injected only for pertinent html elements (RADAR-7131)
Refactored the request object representation to enable various kind of payloads (JSON, XML) (RADAR-10741)

Fixed issues:

Form extractor properly parses inappropriately encoded form values (RADAR-10975)
Referrer header is handled properly within the authentication flow for redirect requests (related to RADAR-10868)
Fixed login authentication flow to better support cases where the active session cookie is added to the scan configuration

Sylwia

Old change logs

Publication time frame: January 2018 - April 2018

Version 2.7.0, released January 10, 2018

New features and improvements:

GetXss plugin was rewritten, some new XSS cases can be found.
Some plugins report the execution path in the 'Finding' field.
POST request in execution path contains body.
Form extraction was optimized.

Fixed issues:

Fixed problem with stopping scan progress.
Invalid URLs in parsed HTML do not blow up the scan.
OpenRedirect plugin fixed.

Version 2.7.1, released January 11, 2018

Fixed issues:

Fixed NullReference issue in PostXss plugin.
Invalid URLs in parsed HTML do not stop the scan.

Version 2.8.0, released January 12, 2018

New features and improvements:

Some plugins report the execution path in the 'Finding' field.
Detection of vulnerabilities for GetXss and PostXss plugins improved.

Fixed issues:

Fixed ESENT storage issue.

Version 2.8.1, released January 15, 2018

Fixed issues:

Technical change within the build process.

Version 2.8.2, released January 23, 2018

Fixed issues:

Fixed issue with too long string in 'issuedetails' field in raport.xml which precluded the RSC from loading it.

Version 2.8.3, released January 24, 2018

Fixed issues:

Fixed issue with overriding "Host" header by a parameter from configuration.

Version 2.8.4, released January 26, 2018

Fixed issues:

Fixed issue with invalid string in 'injection/value' field in report.xml.

Version 2.9.0, released March 07, 2018

New features and improvements:

Forceful browsing feature implemented:
- Four plugins (that can report findings) responsible for various variants:
  - Common directories - looks for common directory names (only inside the root of the site)
  - Common files - looks for common file names (only inside the root of the site)
  - Backup directories - looks for some backups of directories, where directory names are generated dynamically from current crawling context (current resource)
  - Backup files - looks for some backups of files, where file names are generated dynamically from current crawling context (current resource)
- The final report includes at most 20 findings from each forceful browser, but all findings are listed in the log file
- Crawlable findings (that can be hit by crawling) of forceful browsing are not reported
- Only confirmed findings are taken into account for further processing
Some other forceful browsing behavior was extracted from code and modeled explicitly as plugins (these cannot report findings, only generate new requests):
IntermediatePaths - generates requests for intermediate paths of the current request
GetWithoutParamsFromPost - generates a GET request without any parameters (neither post parameters nor query string parameters)
GetWithParamsFromPost - generates GET requests with query string parameters instead of post parameters
- Every forceful browser plugin can be switched on and off independently (as every plugin)
All attacking plugins report the execution path inside the Finding field
Execution path items are cut carefully (if needed) to avoid discarding important information (e.g. the parameter that is just attacked)
Improved the handling of query string parameters:
- Duplicate parameters are handled (injected) correctly
- More reliable and natural API to ease the creation of new plugins
- FormParamsExcludedFromAttacks - form (post) parameters that should not be attacked
- CookiesExcludedFromAttacks - cookies that should not be attacked
- HeadersAttacked - headers that should be attacked
Some hardcoded parameters were moved into configuration (not visible in the Radar GUI for now)
Refactoring that aims to clean up the scanner model and make further development easier

Fixed issues:

Fixed generation of separate requests from every form select/radio value
Vulnerability checks are done with respect to response body only (without headers)
If auth validation request is not present in recordings, then it is not set to the login request

Version 2.10.0, released April 24, 2018

New features and improvements:

XSS detections rewritten from the scratch with assumptions:
- final stage of the attack should inject an "executable" payload
- injected payload should contain some random part to be distinguishable from old, stored attacks
- all WAVSEP's RXSS basic tests (except exploiting the unsupported VBScript) should pass
New StaticAnalyzer plugin - Unsafe characters in Location: header
Some string-ignore-case comparison optimizations

Fixed issues:

Corrected verification step of time-based sql injection attacks
Fixed issue with generating too many parameters in requests originating from GET forms
Fixed "Out of sessions" ESENT issue

Version 2.10.1, released April 25, 2018

Fixed issues:

Findings per plugin limit decreased from 200 to 100

Version 2.10.2, released April 26, 2018

Fixed issues:

Fixed "System. ArgumentOutOfRangeException" issue related to plugin 44

Version 2.10.3, released April 27, 2018

Fixed issues:

Fixed "System. ArgumentOutOfRangeException" issue related to plugin 44 (v2.10.2 does not cover all cases)