Skip to content

Active scanner rules version 72

Choose a tag to compare

@zapbot zapbot released this 20 Jun 10:36
· 2136 commits to main since this release
2979bfc

Added

  • Some Postgres error messages in the SQL Injection scan rule.
  • All rules have been tagged of interest to Penetration Testers.

Changed

  • SQL Injection scan rule to start using ComparableResponse - part of the work to reduce False Positives.
  • Depends on an updated version of the Common Library add-on.
  • Due to it being 2025 and the mass adoption of HTTPS: De-prioritized plain HTTP payloads in the External Redirect scan rule.

Fixed

  • SQL Injection scan rule to treat a 500 response to an SQLi attack as a likely vulnerability.
  • Use location header in SQL injection response comparisons (Issue 8651).
  • Addressed False Negative with simple allow list handling in the External Redirect scan rule.