Spiracle 1.8.0

Additions

• Added commons-collections 3.2 dependency for Java RCE deserialization vulnerability via the Apache Invoker Transformer
• Added simple jsp / servlet to request server send back a cookie in the response
• Added new XSS test cases

Spiracle 1.7.0

Feature Release

Additions

• Added deserial.jsp for deserialization testing and commons-fileupload v1.3 dependency for CVE-2013-2186
• Added new XSS test cases

Refactoring

• Minor updates to SQL servlets and jsp page

Spiracle 1.6.0

Feature Release

Additions

• Sybase database support for SQL Injection
• Path Traversal support
• Added SendRedirect servlet
• Added AddCookies servlet

Spiracle 1.5.0

Feature Release

Additions

• Added IBM DB2 compatible SQL injection servlets.
• Added Crash JVM function.
• Added Thread Stacktrace function.
• Added Thread Kill function.
• Added configurable SQLi error return code
• Added support for CSRF testing.
• Added rudimentary command execution capability.

Spiracle 1.4.1

Feature Release

Additions

• Added Additional XSS vectors to allow arbitrary injection at any point within html template page.

Spiracle 1.4.0

Feature Release

Project Refactor

• Moved build and dependency management to Maven. Project now has the capacity to be built against all legal combinations of Java versions 5, 6 and 7 with Servlet API 2.5 or 3.0.

Additions

• Added initial support for Reflected XSS through unsanitised reproduction of all request parameters.
• Added option to support multiple simultaneous JDBC connection pools.
• Added ability to invoke HttpServletRequest methods through front end for validation of character tainting on return.

Removals

• Removed support for unmanaged JDBC connections.

Spiracle 1.3.1

Set default connection type to c3p0

Spiracle 1.3.0

Feature release

Additions

• Added servlet support for MS SQL 2012.
• Added file as URL traversal option.
• Added file as resource stream traversal option.

Spiracle 1.2.0

Feature release

Additions

• Added support for jndi datasource look up.
• Added C3P0 connection pool close on application context destroy.

Spiracle 1.1.1

Bug fix release

Fixes

• Fix for MySQL JDBC connections not being cleaned up after injection mitigation.
• Fix logging SQLException messages from incorrect scope.

Additions

• Internal package name refactor.
• Added application server and application context path logging at start up.