SecurityInnovation/AuthMatrix

Infer "Response Regex" value based on original response

Opened this issue · 5 comments

Thank you for this very nice extension.

I think this feature request hasn't been asked before.

Currently, AuthMatrix uses the regex ^HTTP/1\.1 200 OK in the "Response Regex" column after adding a request. That works okay but it is very common to deal with other responses (e.g. 200 - without "OK" at the end - , 204, redirects, etc), so there is a constant need for tweaking the value. It would be really nice to infer the value based on the original response, so if the request I send to AuthMatrix is returning a HTTP/1.1 200 response, then that value would be used in the "Response Regex" column for that particular request (e.g. ^HTTP/1\.1 200)

Regards

I like this idea, and it should be fairly simple to implement.

Of course its best that users manually verify that the regex they are using is infact different for authorized and not authorized responses, but I agree this would be helpful for saving time.

Adding to the v0.7 roadmap. Thanks for the input :)

Added in v0.7

I just updated to 0.7 and tested quickly the new feature. It is working great. It looks a bit messy with the requirement to escape spaces in the regex (e.g. ^HTTP\/1\.1\ 404\ Not\ Found). I think that is not strictly necessary or am I missing something? In any case, great work.

By the way, I logged in because I wanted to add an additional request: The possibility of using a default value. Use case: sometimes all the requests return 200 OK, but the success/failure condition can be found in the body of the request, especially in the case of JSON responses, so I need to change the regex to something like "Result": true for every single request. It would be useful to provide a custom default value and use it for all the requests.

Regards

Thanks for testing the new features! The escaping of spaces is not required, but it is optional for regexes. This is the default behavior of escaping regex strings when using re.escape() in python. I think for now its best to leave it in rather than using a custom regex escaping technique.

Custom regexes will require changes to the UI, so I will have to spend some time thinking about the cleanest way to implement those. Perhaps something similar to what's proposed in issue #20

For a moment I thought this extension was using some sort of voodoo language to perform its black magic and now you are reminding me it is using good old python. Yes, I definitely agree that is the best escaping technique.

As for the UI, it is certainly similar to the request in #20. Would it be possible to add a context-dependent menu when right clicking in some part of the AuthMatrix interface in order to set options (e.g. in the repeater tab, you can right click and select options that allow you to set specific values, as in "Insert bytes ..." ). Otherwise, we are going to have too many buttons.