search

simioni87 / auth_analyzer

Burp Extension for testing authorization issues. Automated request repeating and parameter value extraction on the fly.
MIT License
185 stars 48 forks source link

Supporting URL deduplication #17

Open Regala opened 3 years ago

Regala commented 3 years ago

Hi @simioni87 !

One thing that happens very frequently when doing access control testing is testing the same URLs over and over again. It would be super helpful if the extension supported a very simple URL de duplication feature; so, if ON, a request that has already been processed by Auth Analyzer (e.g. it's already on the results table) would be ignored.

Even a very basic support of this - e.g. really just comparing a GET request if it's exactly the same (not taking in consideration ?parameters for example) would be a huge help.

Thanks!

simioni87 commented 3 years ago

Hi regala.

Thanks for the input, worth to take it into consideration for the next release from my point of view.

For now, you are at at least able to hide duplicates at the table. Means you will only see the first repeated request if any duplicates are present. Have you seen this filter?

BR

Regala commented 3 years ago

Oh, so if you uncheck the duplicates checkbox it only show uniques?

On Thu, Jun 3, 2021 at 12:57 PM simioni87 @.***> wrote:

Hi regala.

Thanks for the input, worth to take it into consideration for the next release from my point of view.

For now, you at at least able to hide duplicates at the table. Means you will only see the first repeated request if any duplicates are present. Have you seen this filter?

BR

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/simioni87/auth_analyzer/issues/17#issuecomment-853813473, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAKRBL23GSNWHM3WUVP2LGTTQ5U4JANCNFSM456NFQGQ .

simioni87 commented 3 years ago

Exactly. However, duplicates are still repeated in the background; they are just not shown in the table...

Regala commented 3 years ago

Gotcha! Ok that's already super good. The additional check could help just to save resources but agree is not essential then, just a cool optimization :)

On Thu, Jun 3, 2021, 13:39 simioni87 @.***> wrote:

Exactly. However, duplicates are still repeated in the background; they are just not shown in the table...

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/simioni87/auth_analyzer/issues/17#issuecomment-853836734, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAKRBL2YMSOPW6K2DHU74ATTQ5ZZJANCNFSM456NFQGQ .