Merge pull request #17 from SasanLabs/FuzzerChanges

Not stopping JWT active scanner on finding client side vulnerability
SasanLabs · Nov 24, 2020 · 278a1e2 · 278a1e2
2 parents 5214f7d + 161140e
commit 278a1e2
Showing 1 changed file with 2 additions and 4 deletions.
diff --git a/src/main/java/org/zaproxy/zap/extension/jwt/JWTActiveScanRule.java b/src/main/java/org/zaproxy/zap/extension/jwt/JWTActiveScanRule.java
@@ -68,7 +68,7 @@ public void init() {
                 maxRequestCount = 8;
                 break;
             case HIGH:
-                maxRequestCount = 12;
+                maxRequestCount = 18;
                 break;
             case INSANE:
                 maxRequestCount = 28;
@@ -105,9 +105,7 @@ public void scan(HttpMessage msg, String param, String value) {
         }
 
         if (JWTConfiguration.getInstance().isEnableClientConfigurationScan()) {
-            if (performAttackClientSideConfigurations(msg, param)) {
-                return;
-            }
+            performAttackClientSideConfigurations(msg, param);
             this.decreaseRequestCount();
         }
         performAttackServerSideConfigurations(msg, param, jwtHolder, value);