Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add HTTP Response Length #34

Open
dropn0w opened this issue Feb 12, 2025 · 0 comments
Open

Add HTTP Response Length #34

dropn0w opened this issue Feb 12, 2025 · 0 comments

Comments

@dropn0w
Copy link

dropn0w commented Feb 12, 2025

It would be great to add two columns to the dashboard: Original Length and Modified Length. This would help filter out false positives.

Currently, the plugin checks if the response has a 200 status code. However, in cases where the modified response also returns 200 but does not indicate broken access control, just a standard message, the plugin still flags it as bypassed, which is a clear false positive.

A reliable way to reduce these false positives would be to compare the content length. If the original and modified content lengths are similar, it strongly suggests that we have broken access control.

Additionally, it might be useful to introduce a condition in the Bypassed flag so that a response is only marked as bypassed if both content lengths are significantly different.

Image Image
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant