SecurityInnovation / AuthMatrix

AuthMatrix is a Burp Suite extension that provides a simple way to test authorization in web applications and web services.
MIT License
614 stars 113 forks source link

Allow multiple regexes to be defined for requests #20

Closed 0xdevalias closed 6 years ago

0xdevalias commented 7 years ago

It would be really useful if I could define multiple regexes for each defined request.

Ideally, on some form of configuration tab, I could:

Then, for each request I can assign one or more of these 'global definitions' to it, and chain them together. Think a basic rules engine type thing:

Came across this need while testing an app that had a few different failure type response (HTTP error code, custom header style redirect, body text, etc)

Eg. For unauthenticated users with POST requests to protected endpoints

HTTP/1.1 200 OK
Cache-Control: private
Date: Mon, 28 Nov 2016 05:16:16 GMT
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 5.2
X-Frame-Options: SAMEORIGIN
X-Responded-JSON: {"status":401,"headers":{"location":"https:\/\/foo.com\/bar\/baz\/Index?ReturnUrl=%2Ffoo%2Fbar%2FBoinkt"}}
X-XSS-Protection: 1; mode=block
Content-Length: 0
Connection: Close
mickayz commented 7 years ago

Thanks for the input! I will consider this concept for a future release.

mickayz commented 7 years ago

I am still considering how to add this without complicating the UI too much.

In the meantime, can you accomplish your use case by using the "or" regex symbol?

example for a failure regex:

(404|X-Error: Fail|Invalid Message)

This should detect a failure on any of the those 3 items at any location within the response.

mickayz commented 6 years ago

I've pushed changes in commit c817d58.

The Response Regex field is now a drop-down menu that lists all previously selected regexes, with the ability to type in new ones as well.

If a user wants to change the regex for multiple requests at one time, they can select all relevant requests, right click, select "Change Regexes", and they will be shown a popup allowing them to configure the regexes for these messages using the same dropdown UI as well as a checkbox for Failure Mode.

While this doesn't quite meet the criteria for changing the default regex, it does allow users to update the regexes for each request in one quick and easy step. I selected this option because I believe it has the best UX for the majority of configurations.

Please let me know if this feature fits your needs (it will be part of the 0.8 release in the coming weeks). If not, feel free to open the issue once more and we can discuss alternate solutions.

Thank you for the feedback! -Mick

0xdevalias commented 6 years ago

Haven't used this in anger yet, but it looks like it would solve my needs. Thanks!