An update for WebInspect is now available via SmartUpdate. The update includes some great changes which have been detailed below. Enjoy!
Improvements to the Regular Expression Editor
Optimized some functions for improved performance (language syntax application, syntax evaluation triggering points, etc).
Disabled match tree updates on match fill. Refactored control that contains text to test and disabled painting while highlighting. Improved test for validity of request/response templates.
Enhancements to the Cross-Site Scripting (XSS) Engine
Improved detection of Cross-Site Scripting vulnerabilities and improved consistency in stored Cross-Site Scripting detection. Improved accuracy of Cross-Site Scripting against Domino HTTP headers, as well as when filters are used to remove "alert" from the query string, in Header Injection, and in chain drop-down sites.
Significant SQL Injection Engine Improvements
Improved "diffing" technology for blind SQL Injection. Implemented data extraction for proving confirmed SQL Injection. Improved vulnerability categorization, and created a new check that is flagged when SQL Injection is confirmed but data extraction is not possible because of some limitations such as database not supported, database version does not support data extraction, et cetera.
Enhancements to the JavaScript Parser
Fixed a recurring error when parsing script out-of-process and enhanced the detection of forms in JavaScript so that more forms are found.
Improved Results for Web Brute
Integrated DiffEngine changes into Web Brute for improved results.
Stability Enhancements
Significant work was put towards closing a large number of outstanding issues. See the release notes for more details.
Miscellaneous Improvements
Additional enhancements include better handling of Proxy PAC files, Firefox Proxy support, and improved Oracle application support. Additionally, the "Manage Existing Scans" dialog now remembers its window size and position.
For additional details and a full list of issues resolved, check out the release notes.
- Joe
Posted
06-12-2008 11:00 AM
by
joe.yeager