You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
It would be great to add two columns to the dashboard: Original Length and Modified Length. This would help filter out false positives.
Currently, the plugin checks if the response has a 200 status code. However, in cases where the modified response also returns 200 but does not indicate broken access control, just a standard message, the plugin still flags it as bypassed, which is a clear false positive.
A reliable way to reduce these false positives would be to compare the content length. If the original and modified content lengths are similar, it strongly suggests that we have broken access control.
Additionally, it might be useful to introduce a condition in the Bypassed flag so that a response is only marked as bypassed if both content lengths are significantly different.
The text was updated successfully, but these errors were encountered:
It would be great to add two columns to the dashboard: Original Length and Modified Length. This would help filter out false positives.
Currently, the plugin checks if the response has a 200 status code. However, in cases where the modified response also returns 200 but does not indicate broken access control, just a standard message, the plugin still flags it as bypassed, which is a clear false positive.
A reliable way to reduce these false positives would be to compare the content length. If the original and modified content lengths are similar, it strongly suggests that we have broken access control.
Additionally, it might be useful to introduce a condition in the Bypassed flag so that a response is only marked as bypassed if both content lengths are significantly different.
The text was updated successfully, but these errors were encountered: