scriptoriumadmin/strix
1
0
Fork 0
mirror of https://github.com/usestrix/strix.git synced 2026-09-05 08:06:08 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

add empty-array IDOR FP and OAST source-IP SSRF FP signals (#183)

Browse source
This commit is contained in:
Jorge Moya 2026-05-03 20:19:57 -05:00 • committed by GitHub
parent f1f0b75000
commit be29feb57a
2 changed files with 2 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
strix/skills/vulnerabilities/idor.md
View file

@ -187,6 +187,7 @@ query IDOR {
- Soft-privatized data where content is already public
- Idempotent metadata lookups that do not reveal sensitive content
- Correct row-level checks enforced across all channels
- Empty array / null returned for another user's resource — silent enforcement, not exposure; compare against the owner's view to confirm the data is actually missing rather than just hidden from the response shape
## Impact

1
strix/skills/vulnerabilities/ssrf.md
View file

@ -157,6 +157,7 @@ Server-Side Request Forgery enables the server to reach networks and services th
- Strict allowlists with DNS pinning and no redirect following
- SSRF simulators/mocks returning canned responses without real egress
- Blocked egress confirmed by uniform errors across all targets and protocols
- OAST callbacks where the source IP matches the tester's machine, not the server — the browser or a client-side fetch made the request, not the backend
## Impact