auth_analyzer
auth_analyzer copied to clipboard
[Feature request] - User supplied extra rules for difference algorithm
Hi folks!
Basically this would be a new option where the user could enter a couple of rules that would complement or override the checks used to consider if something is different or not. A quick example would be this:
- Response length is somewhat similar
- The response codes are different (original request
200vs204)
The user could then append a rule saying if request_1 == 200 & if request_1 == 204 -> vulnerable
This could be iterated to also tweak the response length / difference analysis (that I'm not sure how it is done right now); so assuming it's something like if 95% equal -> vulnerable, the user could tweak the 95% to be e.g. 80%.
Just an idea, the extension already works perfectly. Thanks!