Add slow_endpoint_scan module to detect slow HTTP endpoints#1373
Add slow_endpoint_scan module to detect slow HTTP endpoints#1373Prajwal5755 wants to merge 6 commits intoOWASP:masterfrom
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughAdds Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@nettacker/modules/scan/slow_endpoint.yaml`:
- Around line 23-42: The fuzzer step in slow_endpoint.yaml is generating http://
URLs for port 443 (ssl: false with schema: "http" and ports including 443), so
send_request() never exercises HTTPS endpoints; update the YAML to avoid mixing
http with port 443 by either removing 443 from the ports list for this
nettacker_fuzzer entry (keep only 80) or split into two steps: one entry with
ssl: false/schema:"http"/ports:[80] and a second entry with ssl:
true/schema:"https"/ports:[443]; ensure the nettacker_fuzzer block
(url.nettacker_fuzzer, schema, ports, ssl) is adjusted accordingly so
send_request() receives matching scheme and port combinations.
- Around line 12-16: The transport options (timeout, verify, proxies) are
currently nested under payloads and thus ignored by HttpEngine.run which only
forwards step-level fields into send_request; move timeout: 10, verify: false,
and proxies: "" out of the payloads list to the step-level configuration for
this module (and any other similar blocks at lines 18-24) so HttpEngine.run will
pick them up and send_request receives the intended transport settings; look for
the slow_endpoint.yaml payloads block and update the module-level keys
accordingly, ensuring the library: http payload remains a simple entry with no
transport fields.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 5d0d2093-2e07-4485-b5a0-83b2df31b3ce
📒 Files selected for processing (1)
nettacker/modules/scan/slow_endpoint.yaml
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@nettacker/modules/scan/slow_endpoint.yaml`:
- Around line 25-27: The input_format is escaping fuzzer variables so
fuzzer_repeater_perform() only sees literal braces; change the YAML value to use
single braces for the fuzzer placeholders so .format(...) can substitute them
(e.g. use "{schema}://{target}:{ports}/{urls}" instead of
"{{schema}}://{target}:{{ports}}/{{urls}}"), and verify the placeholder names
match what fuzzer_repeater_perform() expects.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: aad07597-1069-499b-a9b0-ddc45890451a
📒 Files selected for processing (1)
nettacker/modules/scan/slow_endpoint.yaml
There was a problem hiding this comment.
🧹 Nitpick comments (1)
nettacker/modules/scan/slow_endpoint.yaml (1)
50-52: Consider removing redundanturlcondition.The
urlcondition withregex: .*matches any URL and provides no additional filtering. You could simplify the configuration by removing it entirely sincecondition_type: andwould still work with justresponsetimeandstatus_code.Suggested simplification
response: condition_type: and log: "response_dependent['url']" conditions: responsetime: "> 3" - url: - regex: .* - reverse: false status_code: regex: 200|401|403 reverse: false🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@nettacker/modules/scan/slow_endpoint.yaml` around lines 50 - 52, The url condition block (url: regex: .*) is redundant because it matches every URL and adds no filtering; remove the entire url condition entry so the rule relies only on the responsetime and status_code conditions under condition_type: and (ensure you delete the url key and its nested regex/reverse fields and keep responsetime and status_code intact).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@nettacker/modules/scan/slow_endpoint.yaml`:
- Around line 50-52: The url condition block (url: regex: .*) is redundant
because it matches every URL and adds no filtering; remove the entire url
condition entry so the rule relies only on the responsetime and status_code
conditions under condition_type: and (ensure you delete the url key and its
nested regex/reverse fields and keep responsetime and status_code intact).
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 5bdab786-287c-4ce9-90d5-27a8a22c8a0e
📒 Files selected for processing (1)
nettacker/modules/scan/slow_endpoint.yaml
There was a problem hiding this comment.
🧹 Nitpick comments (2)
nettacker/modules/scan/slow_endpoint.yaml (2)
14-15: Remove ineffective payload-level settings.Based on
HttpEngine.run()innettacker/core/lib/http.py:177-180, only step-level keys are passed tosend_request(). These payload-levelverifyandproxiessettings are silently ignored. Thessl: falseat line 23 already handles SSL verification at the correct level.♻️ Suggested cleanup
payloads: - library: http - verify: false - proxies: "" steps:🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@nettacker/modules/scan/slow_endpoint.yaml` around lines 14 - 15, The payload-level keys "verify" and "proxies" in slow_endpoint.yaml are ineffective because HttpEngine.run() only forwards step-level keys to send_request(); remove the "verify: false" and "proxies: \"\"" entries from the payload (leaving "ssl: false" intact) so configuration is not misleading; search for the slow_endpoint.yaml payload and delete those two keys referencing verify and proxies.
53-55: Consider expanding status code coverage.The current regex
200|401|403excludes other potentially relevant slow responses:
201,202,204(successful but less common)500,502,503(slow errors may indicate resource exhaustion or DoS surfaces)A slow 500 response could indicate a vulnerable endpoint that exhausts resources. Consider whether
2\d\d|401|403|5\d\dwould be more suitable for comprehensive slow endpoint detection.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@nettacker/modules/scan/slow_endpoint.yaml` around lines 53 - 55, The status_code regex under the status_code key currently matches only "200|401|403", missing other relevant success and error responses; update the regex to broaden coverage (for example to "2\\d\\d|401|403|5\\d\\d") so the slow_endpoint detector includes 2xx variants and 5xx server errors; modify the regex value in slow_endpoint.yaml (the status_code: regex field) accordingly and ensure the reverse flag remains unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@nettacker/modules/scan/slow_endpoint.yaml`:
- Around line 14-15: The payload-level keys "verify" and "proxies" in
slow_endpoint.yaml are ineffective because HttpEngine.run() only forwards
step-level keys to send_request(); remove the "verify: false" and "proxies:
\"\"" entries from the payload (leaving "ssl: false" intact) so configuration is
not misleading; search for the slow_endpoint.yaml payload and delete those two
keys referencing verify and proxies.
- Around line 53-55: The status_code regex under the status_code key currently
matches only "200|401|403", missing other relevant success and error responses;
update the regex to broaden coverage (for example to "2\\d\\d|401|403|5\\d\\d")
so the slow_endpoint detector includes 2xx variants and 5xx server errors;
modify the regex value in slow_endpoint.yaml (the status_code: regex field)
accordingly and ensure the reverse flag remains unchanged.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 94049061-52d1-4f5a-909a-d159d94bd085
📒 Files selected for processing (1)
nettacker/modules/scan/slow_endpoint.yaml
|
|
||
| url: | ||
| nettacker_fuzzer: | ||
| input_format: "{schema}://{target}:{ports}/{urls}" |
There was a problem hiding this comment.
The syntax is wrong , please use {{}} for "target ", "ports" and "urls" fields .
There was a problem hiding this comment.
Thanks for pointing this out, I have updated the syntax to use {{}} for fuzzer variable and pushed the fix
2 participants
Proposed change
This PR introduces a new module
slow_endpoint_scanfor detecting slow HTTP endpoints.The module identifies URLs that take more than 3 seconds to respond. Slow responses may indicate inefficient backend processing, blocking operations, or endpoints vulnerable to resource exhaustion attacks.
The module works by using Nettacker's
responsetimecondition to detect delayed responses and logs the affected endpoint URLs.Tested locally using a Flask-based lab environment with intentionally delayed endpoints to verify detection.
Type of change
Checklist
make pre-commitand confirm it didn't generate any warnings/changesmake test, I confirm all tests passed locallydocs/folder