Say what a cross account finding saw, and drop protected paths from ffuf

A broken object access finding read "confirmed against a control", which
said nothing about what was actually seen.  It now spells out the proof:
the address, that it came from the second account's own pages, the status
each account got, whether the first account saw the same page as the
second (so it read the other account's data), and whether a signed out
request was turned away.  It also says how it was reached: fetch the
address as each account and signed out, and compare.

Content discovery was reporting a protected path as a find.  A 401 or 403
is the server refusing the path, not an exposed file, so it is no longer
reported as a finding, only kept as coverage.  Only a path the server
actually serves is a lead worth showing.

Author: hackrange

app/core/dast_checks/engine.py

@@ -545,11 +545,47 @@ def _run_two_account(spec: dict, ctx: dict, domains, budget: Budget) -> list:
             else:
                 break
         if confirmations == retest and confirmations > 0:
-            findings.append(_finding(spec, a, resp_a, url))
+            f = _finding(spec, a, resp_a, url)
+            f["evidence"] = _two_account_evidence(url, resp_a, resp_b, resp_anon)
+            f["reproduce"] = _two_account_reproduce(url)
+            findings.append(f)
             break   # one solid finding per rule
     return findings
 
 
+def _two_account_reproduce(url) -> str:
+    """How the finding was reached, with the real address: fetch it as each
+    account and signed out, and compare the pages."""
+    return (f"Fetch {url} three ways and compare the responses: signed in as the "
+            f"second account (it returns the object, so the object is the second "
+            f"account's), signed in as the first account (it returns the same page, "
+            f"so the first account read the second account's data), and signed out "
+            f"(it is turned away).  This is how the finding was confirmed.")
+
+
+def _two_account_evidence(url, resp_a, resp_b, resp_anon) -> str:
+    """Spell out what the two account check actually saw, so the finding is
+    specific: the address, the status each account got, whether the first
+    account saw the same page as the second, and whether a signed out visitor
+    was turned away.  These are the facts the differential fired on."""
+    a_st = (resp_a or {}).get("status")
+    b_st = (resp_b or {}).get("status")
+    an_st = (resp_anon or {}).get("status")
+    same_body = (resp_a and resp_b
+                 and _normalize(resp_a.get("body") or "") == _normalize(resp_b.get("body") or ""))
+    bits = [f"The address {url} was found in the second account's own pages.",
+            f"Signed in as the first account it answered HTTP {a_st}, and the second "
+            f"account's own session got HTTP {b_st}"
+            + ("; both accounts saw the same page, so the first account read the "
+               "second account's data" if same_body else "") + "."]
+    if resp_anon is not None:
+        bits.append(f"A signed out request got HTTP {an_st}"
+                    + (", so the page is not simply public." if an_st != 200
+                       else ", so a signed out visitor sees it too."))
+    bits.append("Confirmed and re-tested.")
+    return " ".join(bits)[:800]
+
+
 def _run_probe(spec: dict, client: Client, route: str, oob_value: str) -> dict:
     """Send the probe steps; the last response is what the differential reads.
 

app/core/dast_engines.py

@@ -601,20 +601,25 @@ def parse_dalfox(report: Path, url: str):
 
 
 def parse_ffuf(report: Path, url: str):
-    """Paths it found.  Only the ones whose names mean something become
-    findings, and as info: a path existing is a lead, not a problem.  Every
-    path is handed on to nuclei."""
+    """Paths it found.  Only the ones whose names mean something AND that are
+    actually served become findings, and as info: a path existing is a lead,
+    not a problem.  A 401 or 403 means the path is protected, not exposed, so
+    it is not a finding, only coverage.  Every path is handed on to nuclei."""
     data = _read_json(report)
     if data is None:
         return None
     out, paths = [], []
     for row in data.get("results") or []:
         found = row.get("url") or ""
         paths.append(found)
+        status = int(row.get("status") or 0)
         word = (row.get("input") or {}).get("FUZZ", "")
-        if _FFUF_INTERESTING.search(word):
+        # Only a page the server actually serves (a 200) is a lead worth
+        # reporting.  A 401/403 is the server refusing it, a 3xx is a redirect
+        # away from it; none of those is an exposed file.
+        if _FFUF_INTERESTING.search(word) and status in (200, 206):
             out.append(_finding("ffuf", f"Found {word}", "info", found,
-                                f"HTTP {row.get('status')}, {row.get('length')} bytes",
+                                f"HTTP {status}, {row.get('length')} bytes",
                                 "Check this path is meant to be public."))
     return out, paths