Feature: passing the test details through to the target app.

[paul-hammant]

To debug the target app vetoing attack requests versus not, this was useful for me:

sed -i 's|debugHeaderValue = testCase.Set + " /// " + testCase.Name + " /// " + placeholder.Name + " /// " + encoder + " /// " + hex.EncodeToString([]byte(payload))\
							if len(debugHeaderValue) > 130 {\
								debugHeaderValue = debugHeaderValue[:130] + "..."\
							}|' internal/scanner/scanner.go

It sends a sha256 for now, and maybe the excellent GoTestWaf would wish to optionally retain that - another command line flag?

[paul-hammant]

Scratch the above sed expression, the #265 PR has a more solid implementation

[svkirillov]

Hi!

Could you please clarify the use case for these changes?

[paul-hammant]

Feel free to ignore. I was at a large bank and we were load testing ModSec in a scaled infra. Using GoTestWaf to run sets, made me wish I could correlate better between ... in the other side - the webserver code that was invoking ModSec. I'm not there any more, and I can't recall every aspect of the need there.

[svkirillov]

Ok. Thanks for your comment and sorry for the long wait for a response.

[paul-hammant]

no worries