subdomain_takeover_vuln Flexbe and Uptimerobot false positives?

[edsnowden]

https://github.com/OWASP/Nettacker/blame/f4c1bbfce5a02da0db7e6ddfffc804cda8bf17f2/nettacker/modules/vuln/subdomain_takeover.yaml#L168

Running this test against a subdomain web server that returns a 404 response for its root page triggers the Flexbe and Uptimerobot tests, which happen to be the two tests in the file that check for a 404 response OR a pattern in the response body. Should this be an AND instead?

[securestep9]

@edsnowden please attach a screenshot

[andrianvaleanu]

Chasing false positives is really annoying when you’re just trying to get clean results. It looks like that OR logic is definitely too broad for a 404. Switching to AND should stop those triggers. Check out https://pulsetic.com/ too.

[edsnowden]

Fetching the URL with curl

CSV nettacker output for subdomain_takeover_vuln test on the domain

[securestep9]

Chasing false positives is really annoying when you’re just trying to get clean results. It looks like that OR logic is definitely too broad for a 404. Switching to AND should stop those triggers. Check out https://pulsetic.com/ too.

@andrianvaleanu Please avoid spamming issue threads to promote your startup. Self-promotional off-topic activity violates GitHub’s community rules and can get you banned for spreading Disruptive Content. Let’s keep this discussion focused on the bug report.