From 1ee213d833c66f6798809ae5b5d3897ce51571d8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Krzysztof=20Zaj=C4=85c?= Date: Wed, 21 Feb 2024 14:39:00 +0100 Subject: [PATCH] Fuzzing files is enabled --- README.md | 4 ---- config.py | 3 +-- 2 files changed, 1 insertion(+), 6 deletions(-) diff --git a/README.md b/README.md index 865f59d..d95fcb2 100644 --- a/README.md +++ b/README.md @@ -180,10 +180,6 @@ edit `docker_image/magic_payloads.php` and `docker_image/fuzz/config.py`. `crash_detector.py` contans regular expressions that find interesting crashes or interesting information (e.g. e-mails) being exposed. -Fuzzing files (i.e. executing each PHP file with injected payloads) has been disabled -because it didn't lead to many findings. Uncomment `files` in `config.DEFAULT_ENABLED_FEATURES` -to change that. - Fuzzing REST routes as logged-in admin has been disabled as it led to false positives. Uncomment `rest_routes_admin` in `config.DEFAULT_ENABLED_FEATURES` to change that. diff --git a/config.py b/config.py index 2233d70..3cc94fb 100644 --- a/config.py +++ b/config.py @@ -9,7 +9,6 @@ "find_in_files_after_fuzzing", "find_in_admin_after_fuzzing", "find_in_pages_after_fuzzing", - # Disabled - see README.txt - # "files", + "files", # "rest_routes_admin", ]