Documentation
¶
Index ¶
Constants ¶
const ( ModuleID = "race-interference" ModuleName = "Race Interference Detection" ModuleShort = "Detects input storage, cross-contamination, and request interference races" )
Variables ¶
Functions ¶
This section is empty.
Types ¶
type Finding ¶
type Finding struct {
Type FindingType
Parameter string
Anchor string
WrongIdSeen string
Request string
Response string
}
Finding represents a detected race condition vulnerability.
func (*Finding) Confidence ¶
func (f *Finding) Confidence() severity.Confidence
Confidence returns the per-finding confidence. Request Interference is downgraded to Tentative for the same reason as Severity above.
type FindingType ¶
type FindingType int
FindingType represents the type of race condition finding.
const ( FindingInputStorage FindingType = iota FindingCrossContamination FindingRequestInterference )
func (FindingType) String ¶
func (f FindingType) String() string
String returns a human-readable name for the finding type.
type Module ¶
type Module struct {
modkit.BaseActiveModule
// contains filtered or unexported fields
}
Module detects race condition vulnerabilities through parallel request analysis.
func (*Module) ScanPerInsertionPoint ¶
func (m *Module) ScanPerInsertionPoint( ctx *httpmsg.HttpRequestResponse, ip httpmsg.InsertionPoint, httpClient *http.Requester, scanCtx *modkit.ScanContext, ) ([]*output.ResultEvent, error)
ScanPerInsertionPoint tests a single insertion point for race condition vulnerabilities.
type Options ¶
type Options struct {
// EnableInputStorageDetection detects input values persisting across requests (cache poisoning).
EnableInputStorageDetection bool
// EnableCrossContaminationDetection detects data from request X appearing in response Y.
EnableCrossContaminationDetection bool
// EnableRequestInterferenceDetection detects divergent responses from parallel requests.
EnableRequestInterferenceDetection bool
// BaselineRequestCount is the number of sequential requests for establishing baseline.
BaselineRequestCount int
// ParallelProbeCount is the number of concurrent requests in the parallel probe phase.
ParallelProbeCount int
// ConfirmationRequestCount is the number of sequential requests for confirmation.
ConfirmationRequestCount int
}
Options configures the race interference scanner behavior.
func DefaultOptions ¶
func DefaultOptions() Options
DefaultOptions returns the default scanner options.
type ProbeResult ¶
type ProbeResult struct {
Index int
UniqueID string
Body string
StatusCode int
Headers map[string][]string
Request string
Response string
HasWrongId bool
WrongIdVal string
Err error
}
ProbeResult holds the result of a single probe request.
type ResponseGroup ¶
type ResponseGroup struct {
// contains filtered or unexported fields
}
ResponseGroup holds a merged fingerprint and associated responses for baseline comparison.
func NewResponseGroup ¶
func NewResponseGroup(statusCode int, body string, headers map[string][]string) *ResponseGroup
NewResponseGroup creates a new ResponseGroup from initial response data.
Source Files