Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve "run for each" variables logic #31

Open
Sh1Yo opened this issue Jul 8, 2023 · 1 comment
Open

Improve "run for each" variables logic #31

Sh1Yo opened this issue Jul 8, 2023 · 1 comment
Labels
enhancement New feature or request

Comments

@Sh1Yo
Copy link

Sh1Yo commented Jul 8, 2023

When the run for each variables are used, the requests are getting repeated even though run for each placement may not be reached.

Consider the following situation:

You want to check for xss vulnerabilities. You have 10 payloads in run for each. But before sending those payloads you need to make sure that the injection point reflects on the page to decrease the amount of useless requests.

Example:


metadata:
    language: v1-beta
    name: "Test"
    description: "Tests"
    author: "sh"

run for each:
		calculation = "314116790-1", "314116788+1"

define:
    answer="314116789"

given insertion point then
        # check whether the injection point reflects on the page
	send payload: #[1]
		replacing: {answer}

        # if reflects - send payloads
	if {answer} in {latest.response} then
		send payload:  #[2]
			replacing: {calculation}

		if {answer} in {latest.response} then
			report issue:
			severity: medium
			confidence: tentative
			detail: "v"
		end if
	end if

With this configuration for every #[2] request the #[1] one will be sent as well(even if the first condition won't be reached at all), but the #[1] request needs to be sent only once because the response won't change.

I think it can be solved by adding another special word that will annotate the start of repeating for run for each . For example:

if {answer} in {latest.response} then
    repeat calculation:
        send payload:  #[2]
	    replacing: {calculation}
@A-J-C
Copy link
Collaborator

A-J-C commented Jul 9, 2023

Yes, currently the run for each will always repeat the whole check.

We would need to introduce a more advanced looping syntax for this use case. I'll keep this issue open to track the need for this feature.

@A-J-C A-J-C added the enhancement New feature or request label Jul 9, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Development

No branches or pull requests

2 participants