Skip to content

Make output more clear if the endpoint is or not vulnerable #102

@nrathaus

Description

@nrathaus

At the moment the outcome of endpoint testing is very "human" oriented and very "grammar" sensitive, meaning that a person needs to read each sentence and use logic to understand if the endpoint is or not vulnerable, for example:
Parameters are not vulnerable to SQLi Payload

vs
One or more parameter is vulnerable to SQL Injection Attack

While this is very human way of describing the outcome, going over a report that has a few hundred or thousands of endpoint and trying to find which one are vulnerable is not an easy task

May I suggest two things:

  1. Add a config option that allows returning only endpoints that have a vulnerability (it seems OFFAT returns everything)
  2. Make the outcome True/False rather than textual, result returns True when not vulnerable is the opposite of what people would expect, maybe changing this to vulnerable field and returning True/False or adding a new field called vulnerable that will return True/False when its vulnerable

Metadata

Metadata

Labels

enhancementNew feature or request

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions