Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

False positive when 404 is returned #140

Open
digininja opened this issue Jan 31, 2025 · 0 comments
Open

False positive when 404 is returned #140

digininja opened this issue Jan 31, 2025 · 0 comments

Comments

@digininja
Copy link

Describe the bug
The extension ignores a 404 response and reports the dev console as being exposed when it shouldn't.

To Reproduce
Steps to reproduce the behavior:

Request:

GET /graphiql HTTP/1.1
Host: dvwa.test
Accept-Encoding: gzip, deflate, br
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
Connection: close
Cache-Control: max-age=0


Response:

HTTP/1.1 404 Not Found
Date: Fri, 31 Jan 2025 08:56:12 GMT
Server: Apache
X-Powered-By: Express
Content-Type: text/plain;charset=UTF-8
Content-Length: 25

Cannot GET
/graphiql.php?

This is reported as an issue because of the string match of graphiql in the response even though the response is a 404.

The php extension is just because I had to use a rewrite rule to get this working on my test server, it does the same on a live client site where it returns just /graphiql?.

Expected behavior
Detect 404s and do not report on them.

Screenshots

Image

Image

Image

Desktop (please complete the following information):
Burp 2025.1 on Ubuntu

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant