Skip to content

WebVigil 1.1.0

Latest
Latest

Choose a tag to compare

View all tags
@ryanvmorais ryanvmorais released this 09 Oct 18:59
· 6 commits to main since this release
v1.1.0
3fa3e71
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

A minor release: new options, detector improvements and hardening, all backward compatible. No exit code, existing check id or JSON report field changes.

  • Single-page applications: --har seeds the crawl and the injection pass from a browser or proxy recording, so an app that builds its pages in JavaScript is no longer one empty page.
  • Detectors: a <select> is now fuzzed, --file-upload reaches servers that filter by part type, blind SQL injection is found when a field ships empty, and a GET form that changes state is flagged.
  • Targets: a one-label host (http://app:8000/, a Compose service name) or an IPv6 literal is accepted; [http] total_timeout_s bounds a whole request.
  • Dashboard and Web API: every page has a nonce-based Content-Security-Policy; the API refuses cross-origin state changes, and reports are served with nosniff and a sandbox policy.
  • Upgrade: pipx upgrade webvigil or docker pull ghcr.io/ryanvmorais/webvigil:1.1.0

Scan only systems you own or have permission to test. What is and is not promised across versions: docs/stability.md.

Full list of what changed in 1.1.0: CHANGELOG

Assets 2
Loading