5.4Anomaly Detection

After sending fuzz payloads, you need to detect which responses indicate vulnerabilities:

def detect_anomaly(response, payload_info) -> str | None:
    """Detect if the response indicates a potential vulnerability."""

    # 500 errors on any input = server-side failure (unhandled exception)
    if response.status_code >= 500:
        return f"Server error ({response.status_code}) on {payload_info['category']} payload"

    # Reflection of injected content in response (XSS indicator)
    if payload_info["category"] == "XSS":
        if "<script>" in response.text or "onerror=" in response.text:
            return "XSS reflection detected in response"

    # SQL error messages in response (information disclosure)
    sql_indicators = ["syntax error", "mysql", "postgresql", "sqlite",
                      "ORA-", "unterminated", "unexpected end"]
    if any(indicator in response.text.lower() for indicator in sql_indicators):
        return "Possible SQL error disclosure in response"

    # Stack traces in response (information disclosure)
    if "Traceback" in response.text or "at Object." in response.text:
        return "Stack trace leaked in response body"

    # Unexpected success on malicious input
    if response.status_code == 200 and payload_info["category"] == "SQL_INJECTION":
        return "SQL injection payload accepted without error -- verify data integrity"

    # Sensitive data in error response
    sensitive_patterns = ["password", "secret", "api_key", "token", "credentials"]
    if any(p in response.text.lower() for p in sensitive_patterns):
        return "Potentially sensitive data in error response"

    return None