detector

package
v1.5.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Apr 4, 2026 License: MIT Imports: 12 Imported by: 0

Documentation

Overview

Package detector provides response analysis and vulnerability detection

Package detector provides response analysis and vulnerability detection

Package detector provides response analysis and vulnerability detection

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func ParseAuthContexts

func ParseAuthContexts(args []string) []types.AuthContext

ParseAuthContexts parses auth contexts from CLI arguments

Types

type Analyzer

type Analyzer struct {
	// contains filtered or unexported fields
}

Analyzer analyzes fuzzing results to detect vulnerabilities

func NewAnalyzer

func NewAnalyzer() *Analyzer

NewAnalyzer creates a new response analyzer

func (*Analyzer) AnalyzeResult

func (a *Analyzer) AnalyzeResult(result *fuzzer.FuzzResult, baseline *types.HTTPResponse) []types.Finding

AnalyzeResult analyzes a fuzz result and returns any findings

func (*Analyzer) SetBaseline

func (a *Analyzer) SetBaseline(endpoint types.Endpoint, response *types.HTTPResponse)

SetBaseline sets the baseline response for an endpoint

type AnomalyDetector

type AnomalyDetector struct {
	// contains filtered or unexported fields
}

AnomalyDetector detects anomalies in responses

func NewAnomalyDetector

func NewAnomalyDetector() *AnomalyDetector

NewAnomalyDetector creates a new anomaly detector

func (*AnomalyDetector) Detect

func (d *AnomalyDetector) Detect(result *fuzzer.FuzzResult, baseline *types.HTTPResponse) []types.Finding

Detect detects anomalies in a fuzz result

type AnomalyThresholds

type AnomalyThresholds struct {
	StatusCodeDiff      int
	ContentLengthDiff   int64
	ResponseTimeDiff    float64 // seconds
	SimilarityThreshold float64
}

AnomalyThresholds defines thresholds for anomaly detection

func DefaultThresholds

func DefaultThresholds() AnomalyThresholds

DefaultThresholds returns default anomaly thresholds

type CombinedFilter

type CombinedFilter struct {
	// contains filtered or unexported fields
}

CombinedFilter combines multiple filters

func NewCombinedFilter

func NewCombinedFilter(settings types.FilterSettings) *CombinedFilter

NewCombinedFilter creates a combined filter

func (*CombinedFilter) Filter

func (c *CombinedFilter) Filter(findings []types.Finding) []types.Finding

Filter applies all filters in sequence

type DataLeakDetector

type DataLeakDetector struct {
	// contains filtered or unexported fields
}

DataLeakDetector detects sensitive data leaks in responses

func NewDataLeakDetector

func NewDataLeakDetector() *DataLeakDetector

NewDataLeakDetector creates a new data leak detector

func (*DataLeakDetector) AddRule

func (d *DataLeakDetector) AddRule(rule *LeakRule)

AddRule adds a custom leak detection rule

func (*DataLeakDetector) Detect

Detect detects data leaks in a response

type DetectionRule

type DetectionRule struct {
	Name        string
	Description string
	Type        string
	Severity    string
	Pattern     *regexp.Regexp
	Condition   func(resp *types.HTTPResponse) bool
	CWE         string
	Remediation string
}

DetectionRule represents a detection rule

func (*DetectionRule) Match

func (r *DetectionRule) Match(resp *types.HTTPResponse) bool

Match checks if a response matches the rule

func (*DetectionRule) MatchWithData added in v1.4.0

func (r *DetectionRule) MatchWithData(resp *types.HTTPResponse) (bool, string)

MatchWithData checks if a response matches the rule and returns the matched text

func (*DetectionRule) ToFinding

func (r *DetectionRule) ToFinding() types.Finding

ToFinding converts a rule match to a finding

func (*DetectionRule) ToFindingWithData added in v1.4.0

func (r *DetectionRule) ToFindingWithData(matchedData []string) types.Finding

ToFindingWithData converts a rule match to a finding with matched data evidence

type DifferentialAnalyzer

type DifferentialAnalyzer struct {
	// contains filtered or unexported fields
}

DifferentialAnalyzer compares responses across different auth contexts

func NewDifferentialAnalyzer

func NewDifferentialAnalyzer(contexts []types.AuthContext) *DifferentialAnalyzer

NewDifferentialAnalyzer creates a new differential analyzer

func (*DifferentialAnalyzer) AnalyzeEndpoint

func (da *DifferentialAnalyzer) AnalyzeEndpoint(endpoint string) []DifferentialAnomaly

AnalyzeEndpoint analyzes responses for an endpoint across all contexts

func (*DifferentialAnalyzer) GetContexts

func (da *DifferentialAnalyzer) GetContexts() []types.AuthContext

GetContexts returns the configured auth contexts

func (*DifferentialAnalyzer) SetThresholds

func (da *DifferentialAnalyzer) SetThresholds(thresholds DifferentialThresholds)

SetThresholds sets custom thresholds

func (*DifferentialAnalyzer) StoreResponse

func (da *DifferentialAnalyzer) StoreResponse(endpoint, contextName string, response *types.HTTPResponse)

StoreResponse stores a response for a given endpoint and context

type DifferentialAnomaly

type DifferentialAnomaly struct {
	Type           string   `json:"type"`
	ContextA       string   `json:"context_a"`
	ContextB       string   `json:"context_b"`
	Evidence       []string `json:"evidence"`
	Severity       string   `json:"severity"`
	Confidence     string   `json:"confidence"`
	ExtraFields    []string `json:"extra_fields,omitempty"`
	MissingFields  []string `json:"missing_fields,omitempty"`
	ValueDiffs     []string `json:"value_diffs,omitempty"`
	StatusCodeDiff []int    `json:"status_code_diff,omitempty"`
}

DifferentialAnomaly represents a detected anomaly

func (*DifferentialAnomaly) ToFinding

func (da *DifferentialAnomaly) ToFinding(endpoint, method string) types.Finding

ToFinding converts an anomaly to a Finding

type DifferentialThresholds

type DifferentialThresholds struct {
	FieldCountDiffPercent  float64 `yaml:"field_count_diff_percent" json:"field_count_diff_percent"`
	BodySizeDiffPercent    float64 `yaml:"body_size_diff_percent" json:"body_size_diff_percent"`
	MinFieldsForComparison int     `yaml:"min_fields_for_comparison" json:"min_fields_for_comparison"`
}

DifferentialThresholds defines thresholds for anomaly detection

type EnumerationDetector added in v1.4.0

type EnumerationDetector struct {
	// contains filtered or unexported fields
}

EnumerationDetector detects user/resource enumeration via differential responses

func NewEnumerationDetector added in v1.4.0

func NewEnumerationDetector() *EnumerationDetector

NewEnumerationDetector creates a new enumeration detector

func (*EnumerationDetector) Detect added in v1.4.0

func (d *EnumerationDetector) Detect(result *fuzzer.FuzzResult, baseline *types.HTTPResponse) []types.Finding

Detect checks for enumeration indicators in fuzz results

type ErrorPatternDetector

type ErrorPatternDetector struct {
	// contains filtered or unexported fields
}

ErrorPatternDetector detects error patterns in responses

func NewErrorPatternDetector

func NewErrorPatternDetector() *ErrorPatternDetector

NewErrorPatternDetector creates a new error pattern detector

func (*ErrorPatternDetector) AddRule

func (d *ErrorPatternDetector) AddRule(rule *DetectionRule)

AddRule adds a custom detection rule

func (*ErrorPatternDetector) Detect

Detect detects error patterns in a response

type FindingFilter

type FindingFilter struct {
	// contains filtered or unexported fields
}

FindingFilter filters and deduplicates findings

func NewFindingFilter

func NewFindingFilter(settings types.FilterSettings) *FindingFilter

NewFindingFilter creates a new finding filter

func (*FindingFilter) Filter

func (f *FindingFilter) Filter(findings []types.Finding) []types.Finding

Filter applies filtering rules to findings

type InjectionIndicators

type InjectionIndicators struct {
	SQLErrorPatterns      []*regexp.Regexp
	NoSQLErrorPatterns    []*regexp.Regexp
	CommandErrorPatterns  []*regexp.Regexp
	PathTraversalPatterns []*regexp.Regexp
	LDAPErrorPatterns     []*regexp.Regexp
	XPathErrorPatterns    []*regexp.Regexp
	XSSReflectionPattern  func(payload string) *regexp.Regexp
}

InjectionIndicators holds indicators of successful injection

func NewInjectionIndicators

func NewInjectionIndicators() *InjectionIndicators

NewInjectionIndicators creates injection indicators

func (*InjectionIndicators) CheckCommandInjection

func (i *InjectionIndicators) CheckCommandInjection(body string) (bool, []string)

CheckCommandInjection checks for command injection indicators and returns matched patterns

func (*InjectionIndicators) CheckLDAPInjection added in v1.4.0

func (i *InjectionIndicators) CheckLDAPInjection(body string) (bool, []string)

CheckLDAPInjection checks for LDAP injection indicators and returns matched patterns

func (*InjectionIndicators) CheckNoSQLInjection

func (i *InjectionIndicators) CheckNoSQLInjection(body string) (bool, []string)

CheckNoSQLInjection checks for NoSQL injection indicators and returns matched patterns

func (*InjectionIndicators) CheckPathTraversal

func (i *InjectionIndicators) CheckPathTraversal(body string) (bool, []string)

CheckPathTraversal checks for path traversal indicators and returns matched patterns

func (*InjectionIndicators) CheckSQLInjection

func (i *InjectionIndicators) CheckSQLInjection(body string) (bool, []string)

CheckSQLInjection checks for SQL injection indicators and returns matched patterns

func (*InjectionIndicators) CheckXPathInjection added in v1.4.0

func (i *InjectionIndicators) CheckXPathInjection(body string) (bool, []string)

CheckXPathInjection checks for XPath injection indicators and returns matched patterns

func (*InjectionIndicators) CheckXSSReflection

func (i *InjectionIndicators) CheckXSSReflection(body, payload, contentType string) bool

CheckXSSReflection checks if a payload is reflected in the response without encoding. Encoded output (<, >, ") means the defense IS working — not a vulnerability.

type LeakRule

type LeakRule struct {
	Name        string
	Description string
	Pattern     *regexp.Regexp
	Severity    string
	Confidence  string
	CWE         string
	Remediation string
	Validate    func(match string, body string) bool // Optional post-match validation
}

LeakRule represents a data leak detection rule

type NoiseFilter

type NoiseFilter struct {
	// contains filtered or unexported fields
}

NoiseFilter filters out common false positives and noise

func NewNoiseFilter

func NewNoiseFilter() *NoiseFilter

NewNoiseFilter creates a noise filter with default patterns

func (*NoiseFilter) AddPattern

func (n *NoiseFilter) AddPattern(pattern NoisePattern)

AddPattern adds a custom noise pattern

func (*NoiseFilter) Filter

func (n *NoiseFilter) Filter(findings []types.Finding) []types.Finding

Filter applies noise filtering to findings

type NoisePattern

type NoisePattern struct {
	Name        string
	Condition   func(finding types.Finding) bool
	Description string
}

NoisePattern represents a pattern to filter out

type SecurityHeaderDetector added in v1.4.0

type SecurityHeaderDetector struct {
	// contains filtered or unexported fields
}

SecurityHeaderDetector checks HTTP responses for missing security headers.

func NewSecurityHeaderDetector added in v1.4.0

func NewSecurityHeaderDetector() *SecurityHeaderDetector

NewSecurityHeaderDetector creates a new SecurityHeaderDetector.

func (*SecurityHeaderDetector) Detect added in v1.4.0

func (d *SecurityHeaderDetector) Detect(resp *types.HTTPResponse, method, path string) []types.Finding

Detect inspects the response headers and returns a finding for each missing required security header. It deduplicates by endpoint so repeated requests to the same method+path do not produce duplicate findings.

func (*SecurityHeaderDetector) Reset added in v1.4.0

func (d *SecurityHeaderDetector) Reset()

Reset clears the deduplication state so the detector can be reused across scans.

type SensitiveFieldDetector

type SensitiveFieldDetector struct {
	// contains filtered or unexported fields
}

SensitiveFieldDetector detects sensitive fields in responses

func NewSensitiveFieldDetector

func NewSensitiveFieldDetector() *SensitiveFieldDetector

NewSensitiveFieldDetector creates a detector for sensitive fields

func (*SensitiveFieldDetector) DetectInJSON

func (d *SensitiveFieldDetector) DetectInJSON(body string) []string

DetectInJSON checks for sensitive fields in JSON response

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL