search

bugcrowd / HUNT

Apache License 2.0
2.19k stars 415 forks source link

Incorrect identification of parameters #28

Closed prodigysml closed 7 years ago

prodigysml commented 7 years ago

The parameters being identified using the static analysis is not working as it should (in my opinion at least). I think the tool should filter out cases where the analysed string is a sub-string of the parameter, as displayed below: image (For the string no, in IDOR)

To by honest, I'm not sure if that is intentional, as I can see why it can be.

Finally just wanted to say, great job with the plugin! It's actually really nice to use! :)

prodigysml commented 7 years ago

Actually don't worry about this. Definitely intentional and useful too!