auth_headers_detect

package
v0.5.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 3, 2026 License: MIT Imports: 12 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	ModuleID    = "auth-headers-detect"
	ModuleName  = "Auth Headers Detect"
	ModuleShort = "Detects authorization headers in requests"
)

Variables

View Source 
var (
	ModuleDesc = `` /* 622-byte string literal not displayed */

	ModuleConfirmation = "" /* 176-byte string literal not displayed */
	// Observing that a client sent its OWN Authorization header to its OWN API
	// over TLS is reconnaissance/inventory, not a vulnerability — the credential
	// was never disclosed to a third party. The module text says "Informational",
	// so the severity must match: reporting this at Medium produced a large volume
	// of over-severe findings (one per authenticated endpoint) across every host.
	ModuleSeverity   = severity.Info
	ModuleConfidence = severity.Tentative
	ModuleTags       = []string{"authentication", "info-disclosure", "light"}
)

Functions

This section is empty.

Types

type Module 

type Module struct {
	modkit.BasePassiveModule
	// contains filtered or unexported fields
}

func New 

func New() *Module

func (*Module) ScanPerRequest 

func (m *Module) ScanPerRequest(ctx *httpmsg.HttpRequestResponse, scanCtx *modkit.ScanContext) ([]*output.ResultEvent, error)

ScanPerRequest analyzes request headers for authorization tokens.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.