-
Notifications
You must be signed in to change notification settings - Fork 87
Make output more clear if the endpoint is or not vulnerable #102
Copy link
Copy link
Closed
Labels
enhancementNew feature or requestNew feature or request
Description
At the moment the outcome of endpoint testing is very "human" oriented and very "grammar" sensitive, meaning that a person needs to read each sentence and use logic to understand if the endpoint is or not vulnerable, for example:
Parameters are not vulnerable to SQLi Payload
vs
One or more parameter is vulnerable to SQL Injection Attack
While this is very human way of describing the outcome, going over a report that has a few hundred or thousands of endpoint and trying to find which one are vulnerable is not an easy task
May I suggest two things:
- Add a config option that allows returning only endpoints that have a vulnerability (it seems OFFAT returns everything)
- Make the outcome True/False rather than textual,
resultreturns True when not vulnerable is the opposite of what people would expect, maybe changing this tovulnerablefield and returning True/False or adding a new field calledvulnerablethat will return True/False when its vulnerable
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
enhancementNew feature or requestNew feature or request