Version 3.0 is our biggest release so far. The main focus was straightforward: make scans faster, improve detection, and make the application easier to use.
Scans are up to 10× faster
We redesigned the way tests are executed, which can make scans up to 10× faster.
We also added caching for HTTP requests and Chromium JavaScript evaluations. The scanner can reuse work it has already done instead of repeating the same operations.
You can now control the maximum number of CPU threads used during a scan as well. This gives you a way to trade scan speed for CPU usage when needed.
Save and load scan projects
You can now save a scan project and load it again later.
You can now save completed scans for future reference. In this version, scans can only be saved after they finish. In a future release, you’ll be able to pause a long-running scan, save it, and load it later without starting over. Saved scan projects will also let you take advantage of future features, such as generating new reports from your existing projects.
A UI that is easier to work with
Version 3.0 adds dark mode and a number of smaller UI improvements.
The findings list and details view now have adjustable column widths, so you can give more space to the information you care about. We also cleaned up various parts of the interface and made the overall layout more consistent.
Better XSS detection
Version 3.0 catches several XSS cases that previous versions could miss.
The scanner now checks for XSS in JavaScript string literals with unescaped backslashes and in JavaScript template literals. We also fixed cases where XSS was incorrectly reported in non-HTML content or where the generated XSS payload was incorrect.
Other detection fixes cover hidden URLs, Windows OS command execution, HTTP Basic Authentication weak passwords, and missing Strict-Transport-Security headers.
The goal is fewer missed vulnerabilities and fewer findings that turn out not to be real issues.
More useful findings
We improved the details shown for weak password findings and made the ordering of additional information consistent in finding details.
HTTP responses are also truncated more accurately now, which makes large responses easier to work with without losing the relevant information.
A lot of stability fixes
We fixed several issues that could cause scans to freeze, get stuck, or stop progressing. We also fixed the frozen progress display.
Other fixes include incorrect JSON parameter handling, missing issue descriptions for PHP CGI Argument Injection RCE, and several false-positive findings.
There are plenty of smaller fixes in this release as well. See the full Version 3.0 release notes for the complete list.
Version 3.0 is available now.
