Documentation
¶
Index ¶
- Constants
- Variables
- type Module
- func (m *Module) CanProcess(ctx *httpmsg.HttpRequestResponse) bool
- func (m *Module) Fresh() any
- func (m *Module) HasCompareClients() bool
- func (m *Module) ScanPerRequest(ctx *httpmsg.HttpRequestResponse, httpClient *http.Requester, ...) ([]*output.ResultEvent, error)
- func (m *Module) SetCompareClients(clients []*http.Requester, names []string, hostnames ...[]string)
Constants ¶
const ( ModuleID = "authz-compare" ModuleName = "Cross-Session Authorization Compare" ModuleShort = "Compares responses across authenticated sessions to detect IDOR/BOLA" )
Variables ¶
var ( ModuleDesc = `` /* 663-byte string literal not displayed */ ModuleConfirmation = "" /* 180-byte string literal not displayed */ ModuleSeverity = severity.High ModuleConfidence = severity.Firm ModuleTags = []string{"idor", "bola", "auth-bypass", "access-control", "api-security", "moderate"} )
Functions ¶
This section is empty.
Types ¶
type Module ¶
type Module struct {
modkit.BaseActiveModule
// contains filtered or unexported fields
}
Module implements the cross-session authorization comparison scanner.
func (*Module) CanProcess ¶
func (m *Module) CanProcess(ctx *httpmsg.HttpRequestResponse) bool
CanProcess skips this module if no compare sessions are configured.
func (*Module) Fresh ¶
Fresh implements modules.PerScanModule so the runner gives each scan its own instance — per-scan compare clients set via SetCompareClients must not leak across concurrent server-mode scans.
func (*Module) HasCompareClients ¶
HasCompareClients returns true if compare sessions are configured.
func (*Module) ScanPerRequest ¶
func (m *Module) ScanPerRequest( ctx *httpmsg.HttpRequestResponse, httpClient *http.Requester, scanCtx *modkit.ScanContext, ) ([]*output.ResultEvent, error)
ScanPerRequest replays the request with each compare session and compares responses.
func (*Module) SetCompareClients ¶
func (m *Module) SetCompareClients(clients []*http.Requester, names []string, hostnames ...[]string)
SetCompareClients configures the HTTP requesters for compare sessions. Each requester has its own cookie jar and custom headers matching a session. The optional hostnames slice enables per-hostname filtering: clients with a non-empty hostname are only used for requests matching that hostname.
Source Files