Auxiliary::Web::Analysis::Taint#taint_analysis: added a bit of differential logic to avoid false positives in case the default responce matches the pattern we're looking for [FIXRM #7559]

unstable
Tasos Laskos 2012-12-04 00:09:54 +02:00
parent dafa984166
commit beffd1feda
1 changed files with 7 additions and 3 deletions

View File

@ -20,10 +20,14 @@ module Analysis::Taint
# opts - Options Hash (default: {})
#
def taint_analysis( opts = {} )
return if fuzzed? :type => :taint
fuzzed :type => :taint
return if fuzzed? :type => :taint
fuzzed :type => :taint
fuzz_async do |response, permutation|
# if we get a result without injecting anything then bail out to avoid
# an FP
return if fuzzer.find_proof( submit, self )
fuzz_async do |response, permutation|
next if !response || !(proof = fuzzer.find_proof( response, permutation ))
fuzzer.process_vulnerability( permutation, proof )
end