Resources
Change Log
These are the latest updates we've made to our platform. If you have any questions about any of the updates you see below, please feel free to contact us!
April 2023 Changes
Exploitation capabilities added to the XSS detector
We've added new exploitation capabilities to our Website Scanner that allow you to read the cookies and localStorage of a web app vulnerable to XSS.
Include scan_id to callback headers
If you are a heavy API user, you can now identify which scan a callback is from by using the included scan_id. You can find it in the header of a callback.
Add specific filters for Assets & Scans page
You can now search and filter for specific keywords on the Scans and the Assets page to easily identify a target or scan. Use single quotes or double quotes to achieve this.
Select which extractors to run with the Sniper Auto-Exploiter
You now have the option to select which artefacts you want to extract from the target.
VMware ESXi support available for VPN Agents
We've added official support for VMware ESXi for our VPN Agent.
Exploit for CVE-2023-28432 (Information Disclosure in Minio)
Sniper can exploit an Information Disclosure vulnerability in Minio (CVE-2023-28432).
SPA now available for all customers
Our upgraded Website Scanner effortlessly identifies SPAs by harnessing browser-based spidering. Seamlessly explore websites by selecting the SPA option under Custom Scan->Engine Options->Spidering Approach. Moreover, when opting for the Full Scan with SPA detection, our tool automatically enables browser-based spidering for a comprehensive scanning experience.
New tool: API Scanner
The API Scanner is a powerful tool developed by our team to deeply analyze and optimize API endpoints for reliability, and security. Building on the success of our custom website vulnerability scanner, a comprehensive web application scanner, the API Scanner delivers precise vulnerability detection and actionable insights for your APIs. You can set custom headers that will be sent with each request to the server. E.g.: JWT tokens, authorization headers, etc.
Custom scan time limits for All Tools
Take full control of your scanning experience by setting a custom scan time on your scans. Unlock the perfect balance between thorough coverage and accelerated results.
New predefined HTTP Lockpicker pentest robot
The HTTP Lockpicker is a new Robot designed to crawl for web login interfaces and gain unauthorized access through them using a dictionary-based brute force attack.
Exploit for CVE-2022-41352 (RCE in Zimbra)
Sniper can exploit an RCE vulnerability found in the archive unpacking utility named cpio, which is part of the Zimbra Collaboration (CVE-2022-41352).
Exploit for CVE-2019-11581 (RCE in Jira)
Sniper can exploit an RCE vuln discovered in Jira (CVE-2019-11581).
Exploit for CVE-2023-21839 (RCE in the Oracle WebLogic Servers)
Sniper can exploit an RCE vuln discovered in the Oracle WebLogic Servers (CVE-2023-21839).
New recursive brute force method added to the Subdomain Finder
With this new method, the Subdomain Finder searches for subdomains in a recursive manner. When a subdomain is discovered, a new search is started using a different list of words specifically for subdomains. This process continues until no more subdomains are found.
Bing Search now available for the Subdomain Finder
The Subdomain Finder now includes an option (enabled by default) to query Bing Search via its API to search for subdomains.
Don't include fixed vulns for the risk level of a target
Fixed findings are now ignored when calculating the risk level of the target.
Detect HTTP Request Smuggling
You can now detect server-side and client-side Request Smuggling vulnerabilities with our Website Scanner.
New table added to the Scheduler page
What's new: an updated and modern UI, better filtering, a new 'Next scan' column.
March 2023 Changes
Requests and responses added to the findings in Website Scanner
Website Scanner now includes HTTP requests and responses in the findings found with the Website Scanner.
Exploit for CVE-2023-23752 (flaw in Joomla)
Sniper can exploit a critical flaw in Joomla 4.0.0 through 4.2.7. An improper access check allows unauthorized access to web service endpoints. (CVE-2023-23752)
Extract database version in the SQL injection attacks
Website Scanner now extracts the database version after checking and finding SQL injection.
Included URLs to the scope
We've added the option to include separated URLs in the Website Scanner to make sure there aren't any redirects and you are scanning the correct ones. You can add a list of your specific URLs and start scanning.
Detect Client-side template injection
You can now check for XSS through template expressions in AngularJS and Vue apps using our Website Scanner.
Detect Blind XSS Injection
We've added the Blind XSS injection type (to the current XSS detectors) you can now detect with our Website Scanner.
Detect SQL Injection in Order/Group by with the Website Scanner
We've added 'Group/Order By' payloads in our SQL Injection detector from Website Scanner so you can better detect these high-risk vulns.
Extensive modules in Network Scanner + Sniper
We have a new scan option 'Enable extensive modules' you can use to run for an extended period of time. Enabling this option increases the scan duration.
Exploit for CVE-2022-42889 (RCE in Apache Commons Text)
Sniper can exploit a critical RCE flaw in Apache Commons Text packages 1.5 through 1.9. This vuln affects the StringSubstitutor interpolar class, which is included in the Commons Text library.
Exploit for CVE-2022-39952 (RCE in Fortinet)
Sniper can exploit an unauthenticated RCE vuln found in the external control of file name or path in the Fortinet FortiNAC versions. (CVE-2022-39952)
February 2023 Changes
Automatic updates for VPN Agents
We've implemented an auto-update mechanism system for our VPN Agents. Automatically download and install the newest versions of them. Zero downtime + no redeployment needed.
Exploit for CVE-2022-46169 (RCE in Cacti)
Sniper can exploit an RCE vuln found in the remote_agent.php file of the Cacti servers (CVE-2022-46169)
New Finding templates page
The Finding Templates page also got a fresh look and improved design. You can now search and filter for specific templates in a cleaner interface, and more.
Detect request URL overrides
Some web apps support HTTP headers that can be used to override parts of the request URL. You can now detect them with our Website Scanner.
Exploit for CVE-2023-0699 (RCE in GoAnywhere MFT)
Sniper can exploit a command injection vuln in the License Response Servlet (CVE-2023-0699)
New option to generate a document for the Sniper client-side attack
For the client-side attack option, you can now choose between different types of macros that are added to the document (plain/obfuscated powershell).
Exploit for CVE-2022-44877 (unauth RCE in CentOS Web Panel)
Sniper can exploit an OS command injection vuln found in centOS Web Panel, that allows remote attackers to execute commands via shell metacharacters in the login parameter. (CVE-2022-44877)
Exploit for CVE-2022-47966 (RCE in Zoho ManageEngine)
Sniper can now exploit a RCE in multiple Zoho ManageEngine on-premise products. (CVE-2022-47966)
Exploit for CVE-2017-15944 (RCE in Palo Alto servers)
Sniper can now exploit a path traversal vuln located in the /public/plugins/endpoint of the Palo Alto servers. (CVE-2017-15944)
New All scans page
The All scans page got a fresh redesign. You can now get a better view of your summary, better filtering for your tool names and start dates, expand and collapse all in the grouped view and more.
Display full port range list (1-65535)
When using our Network Scanner, Sniper, or Port Scanners, now you can choose the full port range (starting from 1 to 65535 ports) when scanning your targets.
Add Status in the HTML/PDF reports
We've included a Status label for the findings of your scans in the HTMP and PDF reports.
January 2023 Changes
Windows screenshots in Sniper
Sniper can now take a screenshot of the target system if it runs Windows. The picture will be available in your scan report and it's part of the Proof-of-Exploit.
New filter in robot: login interface found
We added a new filter in our Pentest Robots for the website scanner block: Login Interface Found. This will match every new URL found by website scanner under the finding Login Interface Found. After this filter, you can add a Password Auditor so you can try to detect weak credentials.
Testing for client-side prototype pollution in Website Scanner
Website Scanner can now detect client-side prototype pollution. You can automatically detect sources for prototype pollution in the URL sent via web messages.
New Engagements page
Engagements page also got a fresh look and improved filtering. You can now hide the columns you don’t use to declutter the page and find the entries you want faster.
Exploit for CVE-2019-15107 (RCE in Webmin)
Sniper can now exploit a Remote Code Execution vulnerability in the /password_change.cgi endpoint of the Webmin server. (CVE-2019-15107).
Exploit for CVE-2022-35914 (RCE in GLPI htmlawed)
Sniper can now exploit a Remote Code Execution vulnerability in the htmlawed module from GLPI (CVE-2022-35914).
Exploit for CVE-2022-24112 (RCE in Apache APISIX)
Sniper can now exploit a Remote Code Execution vulnerability in the Apache APISIX API Gateway server (CVE-2022-24112).
Exploit for CVE-2019-1653 (RCE in Cisco)
Sniper can now exploit a Remote Code Execution vulnerability in the web-based management interface of Cisco Small Business routers (CVE-2019-1653).
Requests and responses as evidence in Website Scanner
Website Scanner now has full HTTP requests and responses attachments in the evidence fields for all active detection modules like SQL Injection, XSS, SSRF and all the others. This part of the evidence can help you if you want to manually test the finding.
New White Label page
White Label page got a new look and feel, making it easier for you to perform changes. Now you can preview your custom logo, use tags to quickly change your Subject and more.
December 2022 Changes
Display all ports in Network Scanner
When using our Network Scanner (in any mode), you will now get all the ports, not just the open ones. The goal is to have a better view of the target.
Negation in scan status notification trigger
You can now get notified if a scan doesn't have one or more statuses. You can do this by checking the negation checkbox when creating a new notification.
Test for default credentials
Our Password Auditor will automatically scan for default credentials based on the service or application found.
Exploit for CVE-2021-1472 (RCE in Cisco)
Sniper can now exploit a Remote Code Execution vulnerability affecting the web-based management interface of Cisco Small Business RV Series Routers (CVE-2021-1472).
Yearly option in scheduler
We've added the option to schedule a task once per year.
Custom scan time option in Website Scanner
Overwrite the default maximum time that the Website Scanner is allowed to run (24h). The minimum is 30 minutes if you want to get faster results.
Exploit for CVE-2022-31814 (RCE in pfBlockerNG)
Sniper can now exploit a Remote Code Execution vulnerability affecting pfBlockerNG packages (CVE-2022-31814).
New VPN Profiles page
We have updated the VPN Profile Page with a much more efficient design. You can start your Internal Assessments faster with the easier deployment of VPN Agents, batch testing multiple VPN Profiles, and having all the details at a glance with the new slide-over (such as assigned Workspaces or OpenVPN Logs).
November 2022 Changes
New attack type in Password Auditor: Password Spray
In addition to the existing attack type, Dictionary, we've added a new one. Password Spray will try for every password every username in the wordlist, before moving on to the next password. This helps to avoid account lockouts that would normally occur when brute forcing a single account with many passwords.
Exploit for CVE-2022-29078 (RCE in EJS)
Sniper can now exploit a Remote Code Execution vulnerability affecting EJS (Embedded JavaScript templates) Node.js package (CVE-2022-29078).
Exploit for CVE-2022-1386 (SSRF in Wordpress plugin)
Sniper can now exploit a Server Side Request Forgery vulnerability affecting the Fusion Builder WordPress plugin, used in the well known Avada Wordpress theme (CVE-2022-1386).
Client-side attack in Sniper
You can now use our Sniper tool to create client-side attacks. Generate a 'malicious' file (doc, docm, xls, xlsm) containing obfuscated VBA and send it to your victim user. Once they open and enable the macros, Sniper runs all the extractors on their machine to gather evidence of the successful attack. This approach does not use any exploits.
New Dashboard page
We've replaced the old Dashboard page with a new, beautiful page. Now you can view the trend of vulnerabilities for the current workspace on the last 14 days, see at a glance the whole picture of the attack surface for the current workspace and more.
Detection for CVE-2022-28219 (XXE in Zoho ManageEngine)
Network Scanner can now detect if a Zoho ManageEngine ADAudit Plus server is vulnerable to XML External Entity Injection (CVE-2022-28219).
October 2022 Changes
Exploit for CVE-2022-40684 (Authentication Bypass in Fortinet)
Sniper can now exploit an Authentication Bypass vulnerability affecting Fortinet FortiOS, FortiProxy and FortiSwitchManager (CVE-2022-40684).
Docker APIs in Password Auditor
Password Auditor can now discover the Docker API with no authentication configured.
Vulnerability & Exploit Database
We've created the Pentest-Tools.com Vulnerability & Exploit Database, which contains the list of vulnerabilities that can be detected and the exploits that are currently available in the platform.
New Robots page
We've replaced the old Robots page with a new page where you can easily sort, filter and more with our new design.
Detection for CVE-2022-41040/41082 - ProxyNotShell (RCE in Microsoft Exchange Server)
Network Scanner can now detect if a Microsoft Exchange server is vulnerable to Remote Code Execution (CVE-2022-41040/41082).
Detection for CVE-2021-39226 (Authentication Bypass in Grafana)
Network Scanner can now detect if a Grafana server is vulnerable to Authentication Bypass (CVE-2021-39226).
Exploit for CVE-2022-36804 (RCE in Bitbucket)
Sniper can now exploit a Remote Code Execution vulnerability affecting Atlassian Bitbucket (CVE-2022-36804).
CMS Scanners in Robots
Added the possibility to chain the CMS Scanners within the Pentest Robots.
Notification for Confirmed findings
We've added a new filter: get notified if a scan result has confirmed findings.
New Workspaces page
We've replaced the old Workspaces page with a new page where you can easily sort, filter and more with our new design.
September 2022 Changes
Screenshots in Password Auditor findings
Password Auditor will take a screenshot of the authenticated session if weak credentials are found for HTTP web forms.
Detection for CVE-2022-1040 (RCE in Sophos)
Network Scanner can now detect if a Sophos server is vulnerable to a Remote Code Execution vulnerability (CVE-2022-1040).
Exploit for CVE-2017-0144 - Eternalblue (RCE in Remote Desktop Protocol/Services)
Sniper can now exploit a Remote Code Execution vulnerability affecting Remote Desktop Protocol/Services (CVE-2017-0144).
Automatically discover login URLs in Password Auditor
Password Auditor will try to automatically find the login page and attempt web form authentication if there is no login form at the target URL.
Detection for CVE-2022-2884 (RCE in Gitlab CE/EE)
Network Scanner can now detect if a Gitlab Comunity/Enterprise server is vulnerable to a Remote Code Execution vulnerability (CVE-2022-2884).
Exploit for CVE-2022-35405 (RCE in ManageEngine Password Manager Pro and PAM360)
Sniper can now exploit a Remote Code Execution vulnerability affecting ManageEngine, Password Manager Pro and ManageEngine PAM360 (CVE-2022-35405).
Exploit for CVE-2018-1000861, CVE-2019-1003005, CVE-2019-1003029 (RCE in Jenkins)
Sniper can now exploit a Remote Code Execution vulnerability affecting the Jenkins Script Security Plugin (CVE-2018-1000861, CVE-2019-1003005, CVE-2019-1003029).
Find Subdomains is now Subdomain Finder
We changed the name of Find Subdomains to Subdomain Finder for better name consistency.
Authenticated MySQL Sniper scans
Sniper can now authenticate to the target through MySQL using the provided credentials.
Exploit for CVE-2020-29453 (Arbitrary File Read in Jira)
Sniper can now exploit a Pre-Authorization Arbitrary File Read vulnerability affecting Atlassian Jira (CVE-2020-29453).
Detection for CVE-2019-0708 (BlueKeep - RCE in Microsoft Windows)
Network Scanner can now detect if a Microsoft Windows server is vulnerable to a Remote Code Execution vulnerability affecting RDP (CVE-2019-0708).
Exploit for CVE-2022-31656 (Arbitrary File Read in VMware Workspace One)
Sniper can now exploit a Pre-Authorization Arbitrary File Read vulnerability affecting a VMware Workspace One server (CVE-2022-31656).
Detection for CVE-2022-24681 (XSS in Zoho ManageEngine)
Network Scanner can now detect if a Zoho ManageEngine ADSelfService Plus server is vulnerable to Stored Cross-Site Scripting (CVE-2022-24681).
August 2022 Changes
Detection for CVE-2022-34265 (SQLi in Django)
Network Scanner can now detect if a Django application is vulnerable to SQL Injection (CVE-2022-34265).
Exploit for CVE-2022-27925 & CVE-2022-37042 (RCE in Zimbra ZCS)
Sniper can now exploit an Authentication Bypass vulnerability (CVE-2022-27925) and an Arbitrary File Upload (CVE-2022-37042) affecting the Zimbra collaboration suite.
Exploit for CVE-2021-26086 (Arbitrary File Read in Jira)
Sniper can now exploit a Pre-Authorization Arbitrary File Read vulnerability affecting Atlassian Jira (CVE-2021-26086).
Detection for CVE-2020-9490 (DoS in Apache)
Network Scanner can now detect if an Apache HTTP Server is vulnerable to Cache-Digest Denial of Service Attack (CVE-2020-9490).
Website Scanner speed improvements
Website Scanner is now greatly improved (up to 60%) by parallelising the active detectors.
Exploit for CVE-2019-8442 (Arbitrary File Read in Jira)
Sniper can now exploit a Pre-Authorization Arbitrary File Read vulnerability affecting Atlassian Jira (CVE-2019-8442).
Detection for CVE-2020-14179 (Information Disclosure in Jira)
Network Scanner can now detect if a Jira server is vulnerable to Information Disclosure (CVE-2020-14179).
Detection for CVE-2021-3293 (Path Disclosure in Emlog)
Network Scanner can now detect if an Emlog instance is vulnerable to Path Disclosure (CVE-2021-3293).
Exploit for CVE-2021-26085 (Arbitrary File Read in Confluence)
Sniper can now exploit a Pre-Authorization Arbitrary File Read vulnerability affecting Atlassian Confluence (CVE-2021-26085).
July 2022 Changes
Detection for CVE-2018-11784 (Open Redirect in Apache Tomcat)
Network Scanner can now detect if an Apache Tomcat Server is vulnerable to Open Redirect (CVE-2018-11784).
Detection for CVE-2020-3580 (XSS in Cisco ASA and Cisco FTD)
Network Scanner can now detect if the web interfaces of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) are vulnerable to Cross-Site Scripting (CVE-2020-3580).
Detection for CVE-2022-26138 (Authentication Bypass in Atlassian Confluence)
Network Scanner can now detect if an Atlassian Confluence server is vulnerable to an Authentication Bypass vulnerability (CVE-2022-26138).
New Assets page
We've replaced the old Targets page with a new Assets page where you can easily sort, filter and more with our new design. The new version also better reflects the Targets by grouping them under their according Asset and offers more flexibility with selection operations.
SMB support for Password Auditor
Password Auditor can now discover weak credentials for the SMB service.
WinRM support for Password Auditor
Password Auditor can now discover weak credentials for the WinRM service.
Exploit for CVE-2019-7609 (RCE in Kibana)
Sniper can now exploit a Remote Code Execution vulnerability affecting the Timelion visualizer from a Kibana instance (CVE-2019-7609).
Detection for CVE-2022-22980 (RCE in Spring Data)
Network Scanner can now detect if a Spring Data MongoDB application is vulnerable to SpEL(Spring Expression Language) Injection (CVE-2022-22980).
Exploit for CVE-2019-11580 (RCE in Atlassian Crowd)
Sniper can now exploit a Remote Code Execution vulnerability affecting Atlassian Crowd and Crowd Data Center instances (CVE-2019-11580).
New blog design
Our blog just got a massive revamp. We launched a new blog with a fresh redesign that helps you stay focused and get ethical hacking guides from our offensive specialists.
Exploit for CVE-2019-6340 (RCE in Drupal Core)
Sniper can now exploit a Remote Code Execution vulnerability affecting Drupal Core (CVE-2019-6340).
June 2022 Changes
New dorks in Google Hacking
Increased the number of dorks in Google Hacking: find subdomains, search in wayback machine and more.
Exploit for CVE-2022-30525 (RCE in Zyxel Firewall)
Sniper can now exploit a OS command injection vulnerability in the CGI program of Zyxel Firewall (CVE-2022-30525).
AWS Docker Agent
You can now deploy our VPN Agent in any AWS Cloud Infrastructure and start scanning your assets from within the network.
VPN Docker Agent
Deploy the VPN Agent much faster, on any platforms, including Windows, Linux, or even Apple M1, using Docker technology.
Authenticated SMB Sniper scans
Sniper can now authenticate to the target through the SMB protocol using the provided credentials.
Exploit for CVE-2022-26134 (RCE in Confluence)
Sniper can now exploit a Remote Code Execution vulnerability affecting Atlassian Confluence server instances (CVE-2022-26134).
Exploit for CVE-2022-26352 (RCE in DotCMS)
Sniper can now exploit a Remote Code Execution vulnerability affecting DotCMS systems (CVE-2022-26352).
May 2022 Changes
Slack integration
Now you can send Pentest-Tools.com notifications to your Slack workspace.
Exploit for CVE-2022-21371 (LFI in Oracle WebLogic)
Sniper can now exploit a Local File Inclusion vulnerability inside the Console component of Oracle WebLogic Server (CVE-2022-21371).
Detection for CVE-2022-0540 (Authentication Bypass in Jira)
The Network Scanner can now detect if a Jira Seraph (the core authentication mechanism of Jira) instance is vulnerable to authentication bypass (CVE-2022-0540).
Network hosts visual summary in Sniper
Sniper can now create a visual summary for the network hosts that are currently connected on the target and also the adjacent hosts from nearby subnets.
Move data when deleting a workspace
When deleting a Workspace, you will have the option to move the existing targets (and the associated data e.g. scans) to the default workspace or delete everything.
Exploit for CVE-2022-1388 (RCE in F5 BIG-IP)
Sniper can now exploit an RCE vulnerability in F5 BIG-IP (CVE-2022-1388).
Exploit for CVE-2022-29464 (RCE in WSO2)
Sniper can now exploit an unrestricted file upload vulnerability in certain WSO2 products (CVE-2022-29464).
Exploit for CVE-2021-44077 (RCE in Zoho ManageEngine)
Sniper can now exploit an unauthenticated RCE vulnerability in Zoho ManageEngine (CVE-2021-44077).
Detection for CVE-2019-11581 (RCE in Jira)
The Network Scanner can now detect if a Jira Server or Data Center instance is vulnerable to a server-side template injection vulnerability (CVE-2019-11581).
Added API support for Sniper
Sniper can now be accessed via the API.
April 2022 Changes
Exploit for CVE-2022-22954 (RCE in VMware Workspace)
Sniper can now exploit an RCE vulnerability in the VMware Workspace ONE Access (CVE-2022-22954).
Exploit for CVE-2022-0543 (RCE in Redis)
Sniper can now exploit an RCE vulnerability in Redis (CVE-2022-0543).
Exploit for CVE-2022-24086 (RCE in Magento)
Sniper can now exploit an unauthenticated RCE vulnerability in Magento (CVE-2022-24086).
Exploit for CVE-2021-31805 (RCE in Apache Struts 2)
Sniper can now exploit an RCE vulnerability in Apache Struts 2 (CVE-2021-31805).
Exploit for CVE-2018-7600 (RCE in Drupal)
Sniper can now exploit an RCE vulnerability in the Drupal server (CVE-2018-7600).
Exploit for CVE-2018-15961 (RCE in Adobe ColdFusion)
Sniper can now exploit an RCE vulnerability in Adobe ColdFusion (CVE-2018-15961).
Exploit for CVE-2022-22963 (RCE in Spring Cloud)
Sniper can now exploit an RCE vulnerability in Spring Cloud Function - a library in Spring (CVE-2022-22963).
Exploit for CVE-2022-22965 (Spring4Shell - RCE in Spring Core)
Sniper can now exploit an RCE vulnerability in Spring core - a main component of the Java Spring Framework (CVE-2022-22965 - Spring4Shell).
'Unconfirmed' tag for Website Scanner findings
Website Scanner findings that haven't been automatically validated by our scanner and need further manual verification will be marked with the 'Unconfirmed' tag.
Added API support for Domain Finder
The Domain Finder tool can now be accessed via the API.
March 2022 Changes
Authenticated Sniper scans
Sniper can now authenticate to the target service using the provided credentials. Then it will extract the artefacts as an authenticated user.
Exploit for CVE-2022-22947 (RCE in Spring Cloud Gateway)
Sniper can now exploit an RCE vulnerability in Spring Cloud Gateway (CVE-2022-22947).
New parameter in Domain Finder - Minimum Weight
The Domain Finder assigns a certain weight (or certainty) to each result to validate its correctness. Now the value of this parameter can be set to better filter the results.
Exploit for CVE-2017-12611 (RCE in Apache Struts)
Sniper can now exploit an RCE in the Apache Struts Framework (CVE-2017-12611).
February 2022 Changes
Detection for CVE-2020-14882/14883 (Authentication Bypass in Oracle Weblogic)
The Network Scanner can now detect if an Oracle Weblogic Server is vulnerable to an Authentication Bypass vulnerability (CVE-2020-14882, CVE-2020-14883).
Wordlists in Subdomain Finder
Choose your own wordlist or pick from the default ones in order to uncover new subdomains by trying each of them in the DNS Enumeration method of the Subdomain Finder.
Exploit for CVE-2022-23131 (Authentication Bypass and Remote Code Execution in Zabbix)
Sniper can now exploit an Authentication Bypass leading to Remote Code Execution in Zabbix (CVE-2022-23131).
Exploit for CVE-2021-45046 (Log4shell - RCE in Log4j)
Sniper can now exploit an RCE in the Log4j logging library (CVE-2021-45046).
Exploit for CVE-2021-44515 (RCE in Zoho ManageEngine)
Sniper can now exploit an Authentication Bypass and RCE vulnerability in Zoho ManageEngine Desktop Central (CVE-2021-44515).
Exploit for CVE-2021-44228 (Log4shell - RCE in Apache Struts 2)
Sniper can now exploit an RCE in the Log4j logging library from Apache Struts 2 (CVE-2021-44228).
Domain Finder in Robots
Added the possibility to chain the Domain Finder tool within the Pentest Robots.
Detection for CVE-2017-0144 (EternalBlue - RCE in Microsoft Windows)
The Network Scanner can now detect if a Microsoft Windows instance is vulnerable to EternalBlue (CVE-2017-0144).
SSTI detection in Website Scanner
We added to Website Scanner the capability to detect Server-Side Template Injection.
Detect CORS misconfiguration in Website Scanner
We added to Website Scanner the capability to detect dangerous Cross-Origin Resource Sharing (CORS) configurations.
January 2022 Changes
New notification triggers
We added new notification triggers related to the status of a scan: Stopped by user, VPN Error, Auth Error, Conn Error, Aborted.
Exploit for CVE-2018-11776 (RCE in Apache Struts)
Sniper can now exploit an RCE in Apache Struts (CVE-2018-11776).
Exploit for CVE-2020-14883 (RCE in Oracle Weblogic)
Sniper can now exploit an RCE in the Oracle Weblogic server (CVE-2020-14883).
Send notifications to other emails
You can now send a notification to additional emails.
Webhooks
We added Webhooks so you can trigger outgoing HTTP POST requests from Pentest-Tools.com to your endpoints whenever certain events have happened
Detection for CVE-2021-44228 (Log4shell in MobileIron)
The Network Scanner can now detect if a MobileIron Core server instance is vulnerable to Log4Shell (CVE-2021-44228).
Exploit for CVE-2018-2894 (RCE in Oracle Weblogic)
Sniper can now exploit an RCE in the Oracle Weblogic server (CVE-2018-2894).
Exploit for CVE-2021-40539 (RCE in Zoho ManageEngine)
Sniper can now exploit an RCE in the Zoho ManageEngine ADSelfService Plus (CVE-2021-40539).
Detection for CVE-2021-44228 (Log4shell in Elasticsearch)
The Network Scanner can now detect if an Elasticsearch server is vulnerable to Log4Shell (CVE-2021-44228).
Detection for CVE-2021-44228 (Log4shell - RCE in VMware vCenter)
The Network Scanner can now detect if a VMware vCenter instance is vulnerable to Log4Shell (CVE-2021-44228).
Exploit for CVE-2019-17571 (RCE in Log4j)
Sniper can now exploit an RCE in the Log4j logging library (CVE-2019-17571).
Message brokers in Password Auditor
The Password Auditor can now discover weak credentials over the following protocols: MQTT, AMQP, STOMP.
Network Scanner in Robots
Added the possibility to chain the Network Scanner within the Pentest Robots.
Detection for CVE-2021-40438 (SSRF in Apache server)
The Network Scanner can now detect if an Apache HTTP Server is vulnerable to Server Side Request Forgery (SSRF) (CVE-2021-40438).
Exploit for CVE-2020-17409/27866 (Credential Disclosure in Netgear)
Sniper can now exploit an RCE in the Netgear routers (CVE-2020-17409, CVE-2020-27866).
Detection for CVE-2021-44228 (Log4shell in Apache Solr)
The Network Scanner can now detect if an Apache Solr instance is vulnerable to Log4Shell (CVE-2021-44228).
Detection for CVE-2021-44228 (Log4shell in Apache Tomcat)
The Network Scanner can now detect if an Apache Tomcat instance is vulnerable to Log4Shell (CVE-2021-44228).
Detection for CVE-2021-44228 (Log4shell in Apache Druid)
The Network Scanner can now detect if an Apache Druid instance is vulnerable to Log4Shell (CVE-2021-44228).
Detection for CVE-2021-44228 (Log4shell in Apache Flink)
The Network Scanner can now detect if an Apache Flink instance is vulnerable to Log4Shell (CVE-2021-44228).
Exploit for CVE-2021-44228 (Log4shell - RCE in Log4j)
Sniper can now exploit an RCE in the Log4j logging library (CVE-2021-44228).
Exploit for CVE-2021-43798 (Path Traversal in Grafana)
Sniper can now exploit a Path Traversal vulnerability in Grafana (CVE-2021-43798).
December 2021 Changes
Detection for CVE-2021-44228 in Network Scanner (Log4shell - RCE in Log4j)
The Network Scanner can now detect if a server is vulnerable to a RCE vulnerability in the Log4j logging library (CVE-2021-44228).
Detection for CVE-2021-44228 in Website Scanner (Log4shell - RCE in Log4j)
The Website Scanner can now detect the Apache Log4j vulnerability (CVE-2021-44228).
Detection for Ruby Code Injection in Website Scanner
We added detection for Ruby Code injection in The Full Website Scanner.
Exploit for CVE-2021-26295 (RCE in Apache OFBiz)
Sniper can now exploit an RCE in Apache OFBiz (CVE-2021-26295).
Detection for Broken Authentication in Website Scanner
Added detection for Broken Authentication while running an authenticated website scan in the Website Scanner.
Redis support for Password Auditor
Password Auditor can now discover weak credentials for the Redis service.
New target description column
We added the possibility to see the target description in the All Scans page and the scheduler page. To enable it, check
View settings -> Show target description.Detection for CVE-2021-41349 (XSS in Microsoft Exchange)
The Network Scanner can now detect if a Microsoft Exchange server is vulnerable to Pre-Auth POST Based Reflected XSS (CVE-2021-41349).
Exploit for CVE-2017-12617 (RCE in Apache Tomcat)
Sniper can now exploit an RCE in the Apache Tomcat HTTP Server (CVE-2017-12617).
Exploit for CVE-2019-10149 (RCE in Exim)
Sniper can now exploit an RCE in Exim mail server (CVE-2019-10149).
Exploit for CVE-2021-3129 (RCE in Laravel)
Sniper can now exploit an RCE in Laravel PHP framework (CVE-2021-3129).
Detection for Perl Code Injection in Website Scanner
We added detection for Perl Code injection in The Full Website Scanner.
November 2021 Changes
Detection for Python Code Injection in Website Scanner
We added detection for Python Code injection in The Full Website Scanner.
Sniper mode in the Network Scanner
We have a new scan option for the Network Scanner - Sniper scan, a light scan that allows you to check only for the highly exploitable vulnerabilities in a non-intrusive way.
Password Auditor produces findings
The Password Auditor now produces findings. Check the Findings page, where you can modify them and create editable reports.
Exploit for CVE-2019-0230 (RCE in Apache Struts)
Sniper can now exploit an RCE in the Apache Struts 2 Framework (CVE-2019-0230).
Improved scan result for Sniper
We added a new and more interactive interface for the Sniper scan result.
Delete HTTP Request Loggers
We added the possibility to delete existing HTTP Request Loggers.
Exploit for CVE-2017-9791 (RCE in Apache Struts)
Sniper can now exploit an RCE in Apache Struts (CVE-2017-9791).
Exploit for CVE-2014-6271 (ShellShock - RCE in Apache server)
Sniper can now exploit an RCE in Apache server (CVE-2014-6271).
Exploit for CVE-2021-22205 (RCE in Gitlab)
Sniper can now exploit an RCE in the Gitlab CE/EE server(CVE-2021-22205).
Scheduled Robots
The Pentest Robots can now be scheduled to scan recurrently from the targets page.
Detection for CVE-2020-11853/4/ (Authentication Bypass in Micro Focus OBM)
The Network Scanner can now detect if the Micro Focus OBM (Operations Bridge Manager) is vulnerable to Authentication Bypass (CVE-2020-11853 & CVE-2020-11854).
Exploit for CVE-2020-1938 (Ghostcat – LFI in Apache Tomcat)
Sniper can now exploit a Local FIle Inclusion in the AJP connector in Apache Tomcat (CVE-2020-1938).
Exploit for CVE-2019-19781 (RCE in Citrix ADC and Citrix Gateway)
Sniper can now exploit an RCE in Citrix ADC (Application Delivery Controller) and Citrix Gateway (CVE-2021-3223).
October 2021 Changes
Exploit for CVE-2021-3223 (LFI in Node-Red Dashboard)
Sniper can now exploit a Local File Inclusion in the Node-Red Dashboard through a Path Traversal vulnerability (CVE-2021-3223).
Detection for CVE-2021-40539 (RCE in Zoho ManageEngine)
The Network Scanner can now detect if the Zoho ManageEngine ADSelfService Plus is vulnerable to Remote Code Execution (CVE-2021-40539).
Detection for PHP Code Injection in Website Scanner
We added detection for PHP Code Injection in the Full Website Scanner.
Exploit for CVE-2021-42013 (Apache Path Traversal)
Sniper can now exploit an Arbitrary File Read and a Remote Code Execution through a Path Traversal vulnerability in Apache (CVE-2021-42013).
New services supported in Password Auditor
Password Auditor can now discover weak credentials for the following services: Postgresql, Telnet, and VNC.
Exploit for CVE-2021-41773 (Apache Path Traversal)
Sniper can now exploit an Arbitrary File Read and a Remote Code Execution through a Path Traversal vulnerability in Apache (CVE-2021-41773).
Exploit for CVE-2020-3452 (LFI in Cisco ASA and Cisco FTD)
Sniper can now exploit a Local File Inclusion in the Cisco Adaptive Security Appliance or the Cisco Firepower Threat Defense (CVE-2020-3187).
Exploit for CVE-2021-21985 (RCE in VMware vCenter)
The Network Scanner can now exploit an RCE in VMware vCenter (CVE-2021-21985).
September 2021 Changes
More screenshots in the Full Website Scanner
The Full Website Scanner will now generate more screenshots to simplify the reporting flow.
Exploit for CVE-2019-11510 (LFI in Pulse Secure)
Sniper can now exploit a Local File Inclusion in Pulse Connect Secure (CVE-2019-11510).
Detection for CVE-2020-3187 (LFI in Cisco ASA and Cisco FTD)
The Network Scanner can now detect if the Cisco Adaptive Security Appliance or the Cisco Firepower Threat Defense is vulnerable to Local File Inclusion (CVE-2020-3187).
Detection for CVE-2021-22005 (RCE in VMware vCenter)
The Network Scanner can now detect RCE in VMWare vCenter (CVE-2021-22005).
Exploit for CVE-2020-25223 (RCE in Sophos SG UTM)
Sniper can now exploit an RCE in the WebAdmin of Sophos SG Unified Threat Management (CVE-2020-25223).
Confirmed tag for Website Scanner findings
Website Scanner findings that have been automatically validated by our scanner will be marked with the Confirmed tag.
Exploit for CVE-2021-38647 (RCE in Multiple Azure Linux Deployments)
Sniper can now exploit an RCE in the Open Management Infrastructure (OMI) agent that is preconfigured in the Linux VM deployed on Azure (CVE-2021-38647).
Clone Robot
We added the possibility to clone an existing Pentest Robot.
Exploit for CVE-2021-26084 (RCE in Atlassian Confluence)
Sniper can now exploit an RCE in Atlassian Confluence (CVE-2021-26084).
Exploit for CVE-2021-21972 (RCE in VMware vCenter)
Sniper can now exploit an Unauthenticated RCE in VMware vCenter (CVE-2021-21972).
Detection for CVE-2021-24146 (Modern Events Calendar Lite)
The Network Scanner can now detect if Modern Events Calendar Lite is vulnerable to an Unauthenticated Events Export (CVE-2021-24146).
Detection for CVE-2021-21975 (vRealize Operations Manager API SSRF)
The Network Scanner can now detect SSRF in vRealize Operations Manager API (CVE-2021-21975).
August 2021 Changes
Detection for CVE-2021-31195 (ProxyOracle)
The Network Scanner can now detect XSS in the ProxyOracle exploit (CVE-2021-31195).
Detection for CVE-2021-21985 (VMware vCenter RCE)
The Network Scanner can now detect RCE in VMware vCenter (CVE-2021-21985).
Custom limit for Website Scanner requests
Now you can limit the maximum requests (per second) for the Website Scanner. Check the Engine Options → Limits → Requests per second.
Manually reset the API Key
We added the possibility to manually reset the API key.
Recursion in URL Fuzzer
The URL Fuzzer can now do recursive searches by running automatically inside all the directories already discovered.
More enumeration options in WordPress Scanner
The WordPress Scanner can now search for config backups, database exports, or TimThumbs.
Add targets as CIDR
Added the possibility to add targets using the CIDR notation (eg. 192.168.1.0/24).
Detection for CVE-2018-13379 (FortiOS path traversal)
The Network Scanner can now detect CVE-2018-13379 – path traversal in FortiGate SSL VPN appliance.
Added API support for HTTP Logger
The HTTP Request Logger tool can now be accessed via the API.
July 2021 Changes
Detection for CVE-2021-21315 (Node.js Systeminformation RCE)
The Network Scanner can now detect Node.js Systeminformation Command Injection (CVE-2021-21315).
Detection for CVE-2021-28480 (Microsoft Exchange RCE)
The Network Scanner can now detect Remote Code Execution in Microsoft Exchange Server (CVE-2021-28480).
Detection for CVE-2021-34473 (Pre-auth Path Confusion vulnerability)
The Network Scanner can now detect the entry point for the ProxyShell attack chain (CVE-2021-34473).
June 2021 Changes
Scheduled scans can now be run on demand
Added the possibility to run a scheduled scan now, on demand.
Scan Stats for the New Website Scanner
The New Website Scanner will provide at the end of a scan result some stats: URLs spidered, the total number of HTTP requests, error count, etc.
Control the delay between requests in URL Fuzzer
Added to URL Fuzzer the possibility to control the delay between the requests. A retry delays factor is also added to increase exponentially the delay.
May 2021 Changes
Option to filter certain results in URL Fuzzer
Added the possibility to filter certain results (eg. ignore or match certain HTTP codes, ignore or match if the HTML contains a string) to URL Fuzzer.
Increased Wordlist limit
We increased the maximum size of a Wordlist from 10000 words to 50000 words.
OWASP 2013, OWASP 2017 and CWE findings classification
The Website Scanner findings will now be classified by OWASP 2013, OWASP2017 and CWE. Check the Details of a finding to see more.
NTLM support for Password Auditor
The Password Auditor now supports the NTLM authentication protocol.
Custom timing options in URL Fuzzer
Added the possibility to specify custom request timing options and the maximum number of retries to URL Fuzzer.
April 2021 Changes
Support for POST data in URL Fuzzer
The URL Fuzzer now allows you to fuzz HTTP POST requests.
Detection for CVE-2021-21972 (VMware vCenter RCE)
The Network Scanner can now detect the VMware vCenter Unauthenticated RCE (CVE-2021-21972) vulnerability.
New detector added to our New Website Scanner
Our new Website Scanner (currently in beta) will now check for sensitive data (email addresses, social security numbers, credit card numbers) in target applications.
New Website Scanner
We launched a new Website Scanner (currently in beta) fully written by our team. It allows you to select which tests you want to run and it returns less False Positives than the current full scanner.
March 2021 Changes
Detection for CVE-2021-22986 (F5 BIG-IP RCE)
The Network Scanner can now detect the F5 BIG-IP CVE-2021-22986 unauthenticated remote code execution vulnerability.
Detection for Hafnium webshells (ProxyLogon)
The Network Scanner can now detect Hafnium webshells injected during ProxyLogon attacks.
Detection for CVE-2021-2685 (MS Exchange ProxyLogon)
The Network Scanner can now the Microsoft Exchange CVE-2021-26855 SSRF vulnerability (ProxyLogon).
New tests added to Network Scanner
We started to develop custom detection modules which are being added to the standard OpenVAS Network Scanner scans in order to detect high risk vulnerabilities in commercial software.
New payload type in URL Fuzzer
Besides wordlists, the URL Fuzzer can now send a sequence of numbers as payload.
ProxyLogon Scanner
Check if a Microsoft Exchange server is affected by CVE-2021-26855, a vulnerability which can lead to disclosure of sensitive information and to RCE.
February 2021 Changes
More info on Jira issues
The target name and the workspace have been added to the cards created in Jira.
Subdomain Finder improvements
The Subdomain Finder tool has been improved with additional data sources to discover more subdomains.
Notification for ports that shouldn’t be open
You can get a scan notification if the open ports found are other than the ones you defined.
Custom payload in URL Fuzzer
Now you can specify a custom location in URL Fuzzer for the payload using the FUZZ marker in the URL or in query strings.
Custom headers in URL Fuzzer
The URL Fuzzer now allows you to specify custom headers to be sent with each request.
2FA for Advanced
The two-factor authentication is now also available to all the Advanced users (besides Teams).
Custom e-mail subject
Now you can further customize the subject of the mail by changing the placeholders.
E-mail subject changed
The subject of the e-mail generated by a scan will contain the name of the tool, the target and the workspace.
E-mail address changed
All scan results will be sent from the following email address: reports-noreply@pentest-tools.com
Deprecated Citrix and BigIP scanners
The vulnerability scanners for Citrix CVE-2019-19781 and BIG-IP CVE-2020-5902 have been deprecated.
January 2021 Changes
Robots improvements
Multiple stability issues have been fixed.
Robots through VPN
Pentest Robots can now be used to scan the internal networks through VPN.