analyzer

Documentation

Index

• func Analyze(baseline *engine.Response, results []engine.FuzzResult, ...) []*vulns.Finding
• func BehaviorAnalysis(baseline *engine.Response, results []engine.FuzzResult) []*vulns.Finding
• func DifferentialPairs(results []engine.FuzzResult) []*vulns.Finding
• func FilterFalsePositives(baseline *engine.Response, findings []*vulns.Finding, ...) []*vulns.Finding
• func ReflectionScan(results []engine.FuzzResult, baseBody string) []*vulns.Finding
• func TimingAnalysis(baseline *engine.Response, results []engine.FuzzResult) []*vulns.Finding
• type BehaviorCluster

Functions

func Analyze

func Analyze(baseline *engine.Response, results []engine.FuzzResult, modules []vulns.VulnModule, cfg ...engine.Config) []*vulns.Finding

Analyze compares fuzz results against baseline and runs per-module detection

func BehaviorAnalysis

func BehaviorAnalysis(baseline *engine.Response, results []engine.FuzzResult) []*vulns.Finding

BehaviorAnalysis performs anomaly detection on fuzz results. Instead of just pattern matching (nuclei-style), we look for responses that DIFFER from the majority - those are the bugs.

func DifferentialPairs

func DifferentialPairs(results []engine.FuzzResult) []*vulns.Finding

DifferentialPairs sends true/false payload pairs to detect boolean oracles.

func FilterFalsePositives

func FilterFalsePositives(baseline *engine.Response, findings []*vulns.Finding, results []engine.FuzzResult) []*vulns.Finding

FilterFalsePositives removes findings that are just the server echoing back input in error messages, JSON responses, or non-executable contexts.

func ReflectionScan

func ReflectionScan(results []engine.FuzzResult, baseBody string) []*vulns.Finding

ReflectionScan checks if any part of any payload appears in any response (not just exact match)

func TimingAnalysis

func TimingAnalysis(baseline *engine.Response, results []engine.FuzzResult) []*vulns.Finding

TimingAnalysis detects timing-based vulnerabilities across all results.

Types

type BehaviorCluster

type BehaviorCluster struct {
	Fingerprint string
	StatusCode  int
	BodyHash    string
	BodyLength  int
	TimeMs      int64
	Count       int
	Samples     []engine.FuzzResult
}

BehaviorCluster groups similar responses together. The outliers (small clusters) are the interesting findings.