News — vulnerability

Hello all,   Some time ago I announced the arrival of IAST scanning for Rack-based (such as Ruby-on-Rails, Sinatra, etc.) web applications. The feature is now here and I'd like to demo it for you. We have our application, in this case a Sinatra one, and it goes like: As you can see, scnr/introspector has been required and made use of. Now we run a scan with no additional options or configuration: ./bin/scnr http://localhost:4567/ [...] [+] Web Application Security Report - SCNR::Engine Framework [~] Report generated on: 2024-01-08 09:59:13 +0200 [+] System settings: [~] --------------- [~] Version:           1.0dev [~] Seed:...

Hello all, First off, apologies for the made-up name in the title, but I'm not sure what this should be called. Contextual scanning...by that I mean that the user can re-enter the vulnerable state of the web application and debug it right then and there. Like calling IRB or pry at the moment of vulnerability; a real joy for pentesters checking a webapp and developers tasked to fix it alike! In addition, you get coverage data so you'll be able to determine how much of a webapp's codebase was covered by the scan, and thus be able to adjust your...