vulns.co
/
GKData.io MCP

Back to Payloads

OAST correlation markers

A disciplined naming scheme turns callbacks into reproducible evidence. Encode the feature, parameter, attempt number, and a non-secret nonce in every controlled callback URL.

Tags: oast, evidence, correlation, blind

Controlled probes

  • /program/feature-parameter-001-<nonce>
  • Keep an evidence table: request ID, callback ID, timestamp, protocol, result
  • Do not place session tokens, customer data, or credentials in callback paths

Source: https://owasp.org/www-project-web-security-testing-guide/