Effective security validation requires tools that keep pace with infrastructure changes. New operating system releases, expanding web attack surfaces, and diverse enterprise environments all demand that penetration testing platforms continuously extend their capabilities. RidgeBot 6.2 addresses these needs with three significant enhancements: native directory brute-force scanning, expanded WAP support for the latest Windows versions, and unauthenticated SMTP relay support.
What’s New in RidgeBot 6.2?
Version 6.2 focuses on three areas:
- Greater web attack surface coverage — built-in directory brute-force scanning eliminates dependency on external tools
- Expanded WAP compatibility — support for Windows 11 24H2 and Windows Server 2025
- Better enterprise infrastructure integration — unauthenticated SMTP relay for IP-trust-based environments
Below we’ll discuss each of these enhancements in detail.
Native Directory Brute-Force Scanning — What It Is and Why It Matters
One of the first steps in web application penetration testing is directory and file enumeration on the target server. Attackers routinely search for hidden resources — .git repositories left in production environments, configuration files, admin panels, and database backups. Every such artifact is a potential attack vector.
Previously, this type of scanning required integration with external tools such as dirsearch or gobuster. RidgeBot 6.2 introduces native directory brute-force functionality, meaning the entire process takes place within the platform — from discovery through analysis to exploitation.
Dual-Layer Scanning Approach
RidgeBot 6.2 employs a dual-layer scanning architecture that combines speed with accuracy:
Layer 1 — Sensitive Directory Detection:
- A predefined database of over 240 high-risk paths — including
.git,.env,.htaccess, framework configuration files, admin panels, and diagnostic endpoints - Fast scanning focused on the most commonly exploited artifacts
- Minimal load on the scanned system
Layer 2 — Configurable Recursive Traversal:
- Ability to define custom wordlists and patterns
- Recursive directory structure traversal
- Parameters controlling scan depth and breadth
Integration with the Analysis and Exploitation Pipeline
The key advantage of the native approach is full integration with the rest of the platform. Discovered resources are not presented as an isolated list — they feed directly into RidgeBot’s vulnerability analysis engine:
- Brute-force scanning detects an artifact (e.g., an exposed
.git) - The analysis engine evaluates what data can be extracted from it
- The exploitation module attempts to leverage the vulnerability within a broader attack scenario
- Results are combined with other vulnerabilities into exploit chains
This approach is significantly more valuable than manually running dirsearch and manually mapping results to vulnerabilities. Automating the entire process shortens test duration and reduces the risk of missing critical attack paths.
📚 Related concepts: Brute force · Attack surface · Attack surface management
WAP Phase II — Expanded Windows Support
WAP (Windows Attack Proxy) is the RidgeBot module responsible for testing Windows environments from an authenticated user’s perspective. Version 6.2 introduces Phase II of this module, extending compatibility to the latest Microsoft operating system versions.
Newly Supported Platforms
| Operating System | Status in RidgeBot 6.2 |
|---|---|
| Windows 10 (all editions) | Supported |
| Windows 11 (up to 23H2) | Supported |
| Windows 11 24H2 | New in 6.2 |
| Windows Server 2019 | Supported |
| Windows Server 2022 | Supported |
| Windows Server 2025 | New in 6.2 |
Why Support for the Latest Windows Versions Matters
Windows Server 2025 and Windows 11 24H2 introduce significant changes to the security architecture — new credential protection mechanisms, modified group policies, and updated authentication protocols. A penetration testing tool that doesn’t account for these changes may:
- Generate false negatives — fail to detect vulnerabilities specific to new versions
- Misinterpret results — new protection mechanisms may mask real issues
- Miss new attack vectors — every change in security architecture can introduce new, as yet unidentified vulnerabilities
RidgeBot 6.2 addresses these challenges, ensuring that tests in the latest Windows environments produce results as reliable as those in earlier versions.
Stability and Accuracy Improvements
Beyond new platform support, WAP Phase II also includes:
- Stability fixes for long-running test sessions
- Improved vulnerability detection accuracy in environments with multiple domain controllers
- User interface enhancements for clearer result presentation
- Stealth mechanism optimization — RidgeBot 6.2 executes tests in a manner less detectable by EDR/XDR solutions, better simulating real attacker behavior
Unauthenticated SMTP Relay — Enterprise Infrastructure Integration
Many organizations configure their mail servers to accept messages from trusted IP addresses without requiring credentials. This is a common pattern in corporate networks, where internal systems (monitoring, ticketing, automation) send email notifications through a local SMTP relay.
The Problem Before Version 6.2
Earlier versions of RidgeBot required SMTP authentication to be configured for report delivery and task notifications. In environments using IP-based relay, this meant:
- Creating a dedicated SMTP account solely for RidgeBot
- Additional credential administration
- Potential conflicts with security policies restricting service account creation
The Solution in RidgeBot 6.2
RidgeBot 6.2 adds full support for unauthenticated SMTP relay servers:
- UI toggle — a simple switch lets you choose between authenticated and unauthenticated SMTP modes
- Full backward compatibility — existing authenticated configurations continue to work without changes
- API support — configuration is also available via the REST API, facilitating deployment automation
This feature is particularly important for organizations deploying RidgeBot in isolated network segments, where access to external mail servers is limited or impossible.
Additional Improvements in RidgeBot 6.2
Beyond the three main features, version 6.2 introduces several cross-cutting improvements:
- Enhanced execution stealth — improved stealth mechanisms reduce the risk of detection by defensive systems, which is critical for realistic attack simulation
- Improved credential access reliability — more stable credential access mechanisms in multi-target scenarios
- Expanded enterprise integrations — better interoperability with SIEM systems, ticketing, and security orchestration platforms
- More accurate web attack surface discovery — improved crawling and web application fingerprinting algorithms
Who Is RidgeBot 6.2 For?
This version will be particularly valuable for:
Security teams testing web applications — native directory brute-force scanning saves time and ensures result consistency within a single platform.
Organizations migrating to Windows Server 2025 — WAP support for the latest Windows versions means security validation can occur in parallel with migration, not after it.
Enterprise environments with restrictive network policies — unauthenticated SMTP relay removes a deployment barrier in network segments with limited access.
Summary
RidgeBot 6.2 is a release focused on expanding coverage and simplifying integration. Native directory brute-force scanning with over 240 predefined high-risk paths eliminates the need for external tools. Expanded WAP covers the latest Microsoft platforms — Windows 11 24H2 and Windows Server 2025. And unauthenticated SMTP relay support simplifies deployments in complex enterprise environments.
Ridge Security recommends version 6.2 for general availability deployment across production environments.
Want to see how RidgeBot 6.2 can strengthen security validation in your organization? Contact the nFlo team to schedule a platform demo.
Why validation by exploitation changes the queue
A scanner reports that a vulnerability is possible. Validation by actual exploitation reports that it is reachable in this specific configuration — and that difference decides the order of remediation. Several hundred findings marked critical paralyse a team; a dozen confirmed paths give a queue that can be closed.
That is the operating model of the platform described above: see RidgeBot.
Related Concepts
Learn key terms related to this article in our cybersecurity glossary:
- Brute force — An attack method that systematically tests all possible combinations to guess a password or key
- Penetration testing — Controlled attempts to breach IT system security to identify vulnerabilities
- Attack surface — The sum of all points through which an attacker may attempt to gain unauthorized access
- Exploit — Code or technique that leverages a software vulnerability to gain unauthorized access
- Vulnerability Assessment — The process of systematically identifying and evaluating vulnerabilities in IT systems
Learn More
Explore related articles in our knowledge base:
- RidgeBot 6.0: AWS Security Audit and Advanced Windows Testing for Enterprises
- Penetration Testing Automation with RidgeBot
- RidgeBot: Automated Penetration Testing and Security Validation
- RidgeGen: How Generative AI Is Revolutionizing Penetration Testing
Explore Our Services
Need cybersecurity support? Check out:
- Penetration Testing - identifying vulnerabilities in infrastructure and applications
- Security Audits - comprehensive security posture assessment
- SOC as a Service - 24/7 security monitoring
Explore Our Products
Solutions mentioned in this article that can help protect your organization:
- RidgeBot — Ridge Security
