Webbrute rework: HttpCompare baseline + defensive layers - #3166
Merged
Conversation
Contributor
🚀 Performance Benchmark Report
|
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## dev #3166 +/- ##
======================================
+ Coverage 90% 90% +1%
======================================
Files 449 449
Lines 44129 44253 +124
======================================
+ Hits 39447 39572 +125
+ Misses 4682 4681 -1 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
liquidsec
force-pushed
the
webbrute-rework
branch
from
June 14, 2026 15:59
bff3d73 to
0e892ed
Compare
ausmaster
self-requested a review
June 15, 2026 22:26
ausmaster
previously approved these changes
Jun 15, 2026
Replace the strict size/words/lines equality cascade in baseline_fuzz with HttpCompare, the same DeepDiff-based comparison used by paramminer, lightfuzz, bypass403, and wildcard detection. Fixes false-positive floods on hosts with dynamic content (CSRF tokens, timestamps, tracking IDs) that defeated the old cascade and fell through to status-only filtering. Also short-circuits extension iteration after the first host-level abort (WAF, connectivity, 429), saving redundant canary requests.
- avoid_wafs config (default true): skip WAF-tagged hosts in filter_event - Host-level timeout tracking: block hosts after 50 connection failures - sqrt-scaled hit cap: discard + block when hits exceed 4*sqrt(wordlist) - Add Connection header to HttpCompare ignore list (load-dependent noise) - Disable avoid_wafs in dirbust-heavy and kitchen-sink presets - Add tests for hit cap system (TestWebBruteHitCap) - Add webbrute docs page
liquidsec
force-pushed
the
webbrute-rework
branch
from
June 15, 2026 22:30
3b0e705 to
b0169f5
Compare
ausmaster
self-requested a review
June 15, 2026 23:02
ausmaster
approved these changes
Jun 15, 2026
…y-param-keys paramminer: dedup by endpoint + param keys, not full URL string
ausmaster
self-requested a review
June 15, 2026 23:06
ausmaster
approved these changes
Jun 15, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Overhauls webbrute's false-positive prevention based on field testing against real scan data.
HttpCompare baseline: Replaces the old strict size/words/lines equality cascade with HttpCompare (DeepDiff-based). Two baseline requests are diffed to detect dynamic positions (CSRF tokens, timestamps, etc.), which are excluded from future comparisons. This eliminates false-positive floods from servers with per-request dynamic content.
Three-layer post-stream validation: Hits are collected before emission and gated by three checks:
4 * sqrt(wordlist_length)); catches edge cases where the server returns unique content for real words but not random stringsWAF avoidance (
avoid_wafs, default true): Skips hosts tagged as WAF by cloudcheck. Disabled indirbust-heavyandkitchen-sinkpresets.Host-level timeout tracking: Blocks hosts after 50 connection failures (catches packet-dropping WAFs).
HttpCompare fix: Added
Connectionheader to the ignore list -- Apache sendsConnection: closeunder load, causing spurious header diffs.Docs: Added
docs/modules/webbrute.mdcovering features, configuration, WAF handling, and false-positive prevention.Tests: 9 tests total (4 pre-existing + 5 new), covering dynamic content filtering, WAF pages, redirect-to-root, wildcard skip, and hit cap validation.