search

OWASP / OFFAT

The OWASP OFFAT tool autonomously assesses your API for prevalent vulnerabilities, though full compatibility with OAS v3 is pending. The project remains a work in progress, continuously evolving towards completion.
http://owasp.org/OFFAT/
MIT License
456 stars 64 forks source link

Option to bypass host availability check #131

Open jIgnoul opened 2 months ago

jIgnoul commented 2 months ago

If the server now returns a 502 on the root request, the testing will stop. Some servers only reply to valid paths for request. It would be nice if we can have a flag to bypass this "check whether host is available". Further, it appears that this host check request is not passed through the provided http proxy using -p http://127.0.0.1:8080.

dmdhrumilmistry commented 1 month ago

Thanks for reporting the issue. Will take a look into this and get back to you.

dmdhrumilmistry commented 1 month ago

If the server now returns a 502 on the root request, the testing will stop. Some servers only reply to valid paths for request. It would be nice if we can have a flag to bypass this "check whether host is available". Further, it appears that this host check request is not passed through the provided http proxy using -p http://127.0.0.1:8080.

Apologies for the delayed response.

I'll create a new flag to bypass host availability check in the golang version (upcoming latest release if no new critical vulns are introduced in the python version).

Proxy issue has been already handled in the golang version.

I'll keep this issue open until the latest release.