2026.3.0 — Pro
Released September 2026
New
- Time-Based Blind SQLi — detects fully-blind injection through SLEEP / WAITFOR / pg_sleep timing, using a control-pair guard so slow or jittery endpoints are never mistaken for a vulnerability.
- LFI Source Disclosure — probes php://filter wrappers and /proc/self/environ, decoding base64 responses to confirm leaked PHP source or credentials rather than only matching /etc/passwd.
- XSS Form & API Coverage — discovers and tests form fields and JSON API inputs alongside URL parameters, so reflected XSS in POST bodies is no longer missed.
- Request Smuggling Accuracy — GPOST desync confirmation now requires an error-status response echoing the method as a whole word, eliminating false positives from page content such as CSS class names.
- Open Redirect Injection — substitutes payloads into existing query parameters and probes common redirect params, adding meta-refresh detection in place of the append-only test.
- JS Lens — scans JavaScript files for exposed API endpoints, hidden paths, and hardcoded secrets, mapping the client-side attack surface most scanners overlook.
- GraphQL Radar — introspects a GraphQL endpoint and visualises its full schema (types, queries, and mutations), then runs test queries safely behind a mutation guard.
Fixed
- Various bug fixes.