Auxiliary::Web::Analysis::Taint#taint_analysis: added a bit of differential logic to avoid false positives in case the default responce matches the pattern we're looking for [FIXRM #7559]
parent
dafa984166
commit
beffd1feda
|
@ -20,10 +20,14 @@ module Analysis::Taint
|
|||
# opts - Options Hash (default: {})
|
||||
#
|
||||
def taint_analysis( opts = {} )
|
||||
return if fuzzed? :type => :taint
|
||||
fuzzed :type => :taint
|
||||
return if fuzzed? :type => :taint
|
||||
fuzzed :type => :taint
|
||||
|
||||
fuzz_async do |response, permutation|
|
||||
# if we get a result without injecting anything then bail out to avoid
|
||||
# an FP
|
||||
return if fuzzer.find_proof( submit, self )
|
||||
|
||||
fuzz_async do |response, permutation|
|
||||
next if !response || !(proof = fuzzer.find_proof( response, permutation ))
|
||||
fuzzer.process_vulnerability( permutation, proof )
|
||||
end
|
||||
|
|
Loading…
Reference in New Issue