With Version 3.1, you can scan MCP servers, check for PHP2Shell vulnerabilities, and configure scans with more flexibility.
New MCP Security Tests
New MCP server checks cover:
- MCP server exposure: Detects available MCP servers. Currently, only the modern stateless specification is supported.
- Missing authentication: Identifies MCP servers that do not require authentication.
- Prompt injection: Tests for potential prompt injection vulnerabilities.
- Insecure caching: Detects insecure caching of MCP responses.
- Injection vulnerabilities: Tests tool-call parameters for SQL injection, SSRF, path traversal, and other injection issues.
New PHP2Shell Vulnerability Detection
PHP2Shell vulnerabilities can let attackers run operating system commands through vulnerable PHP applications. We’ve added a dedicated test and a passive check to flag applications that may be vulnerable.
Learn how to check an authorized website with the PHP2Shell scanner.
Expanded Vulnerability Detection
We’ve also added or improved checks for:
- Broken Authentication
- Server-Side Request Forgery (SSRF)
- Remote File Inclusion (RFI)
- Local File Inclusion (LFI)
- Path Traversal
- CORS Origin Reflection
- CORS Origin Reflection with Credentials Enabled
- Additional authentication and HTTP security header checks
REST and SOAP APIs are now detected more reliably.
Expanded Technology Support
You can now select Next.js and MCP in scan configurations. Choosing the technologies used by your target can help focus scans.
We’ve also improved detailed Node.js error detection and updated vulnerable version definitions for PHP, Apache, Nginx, OpenSSL, Tomcat, and WordPress.
More Flexible CLI Configuration
CLI scan configuration is more flexible. With sms.exe, you can:
- Pass scan configurations as JSON, either inline or through links.
- Use partial configurations, with missing options automatically filled with default values.
- Control the concurrency of individual test modules.
- Select multiple test modules using a comma-separated list.
Other Improvements and Bug Fixes
We also made several detection fixes:
- Reduced false positives in path disclosure detection.
- Fixed missed SSRF detections.
- Improved HTTP security header and server technology detection.
- Grouped related Windows and Unix path disclosure findings to cut duplicate results.
Upgrade to Version 3.1
To use the new checks and configuration options, upgrade to Version 3.1. See the Version 3.1 changelog for the full list of changes.
