Open andresriancho opened 10 years ago
agreed, let keep this thread as the new requirement of better output / doc.
at the same time, i have found the issue in ur log as stated in this issue https://github.com/neraliu/tpjs/issues/12
and i will open a new issue of why the alert box does not trigger.
When running tpjs against the w3af.org site I get:
From the last lines it seems that the site is vulnerable to DOM-XSS:
But the
TEST URL
(http://w3af.org/?1397133748368&#%3Cimg%20src%3D%22%22%20onerror%3D%22alert(0)%22%3E) doesn't trigger anyalert
box, and the other 100 lines of "debugging information" aren't easy to understand.I could manually analyze all this data (and actually I will) but I'm mostly thinking about users that want to have a more refined result, for example when the REST API is done #8 and in the future I call it from
w3af
... if I show output like this to the user, they will flood me with bug reports :-1: