-
Notifications
You must be signed in to change notification settings - Fork 64
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Make output more clear if the endpoint is or not vulnerable #102
Comments
Currently, OFFAT uses the same payload for every supported parameter while testing for SQLi and other tests. It may be difficult to come to a conclusion programmatically at the moment about which parameter caused it. Initially, I thought It could help users to parse results, compare those and infer which APIs are vulnerable since they'll know their APIs. I'll implement a new tag Adding a new field |
You misunderstood me, today the way to know whether you are or not vulnerable is by Regarding knowing which |
We already have the To make it more clear, what we can do is consider data leak in the overall test result. |
I though I think the word At least that is my opinion |
Since people might get confused with the terms. I'll change |
At the moment the outcome of endpoint testing is very "human" oriented and very "grammar" sensitive, meaning that a person needs to read each sentence and use logic to understand if the endpoint is or not vulnerable, for example:
Parameters are not vulnerable to SQLi Payload
vs
One or more parameter is vulnerable to SQL Injection Attack
While this is very human way of describing the outcome, going over a report that has a few hundred or thousands of endpoint and trying to find which one are vulnerable is not an easy task
May I suggest two things:
result
returns True when not vulnerable is the opposite of what people would expect, maybe changing this tovulnerable
field and returning True/False or adding a new field calledvulnerable
that will return True/False when its vulnerableThe text was updated successfully, but these errors were encountered: