# How Patator Minimizes False Positives During HTTP Authentication Brute‑Forcing

> Minimize HTTP authentication brute-force false positives with Patator. Learn to configure ignore actions for error responses and bolster your security.

- Repository: [lanjelot/patator](https://github.com/lanjelot/patator)
- Tags: deep-dive
- Published: 2026-03-05

---

**Patator prevents false positives during HTTP authentication brute‑forcing by using configurable ignore actions (`-x ignore`) that filter out expected error responses based on status codes, response text, or size, while enforcing safeguards that require explicit user consent to suppress failure reports.**

When conducting HTTP authentication brute‑forcing, security testers often encounter misleading responses that appear as successful logins but are actually standard error pages. The Patator framework (lanjelot/patator) addresses this challenge through a sophisticated filtering system that distinguishes genuine authentication successes from benign failures. This article examines the specific mechanisms in the source code that minimize false positives while maintaining audit integrity.

## Understanding False Positives in Brute‑Force Context

In HTTP authentication testing, a **false positive** occurs when the tool reports a successful credential pair based on an expected error response, such as a `401 Unauthorized` status or a custom error page stating "Login incorrect." Without proper filtering, these standard rejection responses clutter results and waste analyst time. Patator treats any result that satisfies user‑defined ignore conditions as a non‑hit, ensuring only genuine anomalies or successful authentications surface in the final report.

## Core Mechanisms for False Positive Mitigation

### Configurable Ignore Actions via `-x`

The primary interface for false positive control is the `-x` command‑line option, which defines **action filters**. Users specify `ignore` actions followed by conditions that identify expected failures. For example, `-x ignore:code=401` instructs Patator to suppress any response returning an HTTP 401 status code. These rules are parsed in [`src/patator/patator.py`](https://github.com/lanjelot/patator/blob/main/src/patator/patator.py) within the `Controller.update_actions` method (around line 1493), where the framework builds a mapping of conditions to actions.

### Condition Matching Against Response Attributes

After each HTTP request, Patator evaluates the response against the supplied conditions using the `Controller.lookup_actions` method (around line 1496). The framework checks attributes including:

- **`code`**: HTTP status codes (e.g., 401, 403)
- **`fgrep`**: Fixed string matches in response body
- **`egrep`**: Regular expression patterns
- **`size`**: Response length in bytes

If the response satisfies **any** ignore condition, the result is flagged with the `ignore` action and excluded from hit reporting. This evaluation happens in real‑time during the brute‑force iteration, ensuring immediate filtering of predictable error states.

### Default Safeguards and the Override Flag

By design, Patator **does not allow** ignoring failures unless the user explicitly opts in. This prevents accidental suppression of genuine authentication failures that could resemble successful logins. The safeguard is controlled by the `--allow-ignore-failures` flag (defined around line 821 in [`patator.py`](https://github.com/lanjelot/patator/blob/main/patator.py)). Without this flag, even if an ignore condition matches a failure response, Patator logs it as a failure to prevent silent data loss.

The enforcement logic resides in `Controller.report_progress`, which checks both the `allow_ignore_failures` setting and the presence of `ignore` actions before deciding whether to log a failure or suppress it. This dual‑check system ensures that misconfigured ignore rules cannot silently mask real authentication results.

## Source Code Implementation Details

The false positive mitigation logic spans several key components in [`src/patator/patator.py`](https://github.com/lanjelot/patator/blob/main/src/patator/patator.py):

- **`Controller.update_actions`** (line 1493): Parses the `ignore` action and its associated conditions from command‑line arguments, building the internal condition registry.
- **`Controller.lookup_actions`** (line 1496): Matches incoming HTTP response fields (status code, body text, size) against the user‑defined ignore conditions to determine if the result should be suppressed.
- **`Controller.report_progress`**: Implements the conditional check that respects the `--allow-ignore-failures` flag, ensuring failures are only suppressed when the user explicitly overrides the safety guard.
- **`HTTP_fuzz` class** (line 3164): The module that executes HTTP requests and generates the response objects evaluated by the ignore rules.

According to the Patator source code, these components operate sequentially: the controller builds the ignore rules, the fuzzer executes requests, and the lookup mechanism filters responses before they reach the output buffer.

## Practical Configuration Examples

The following commands demonstrate how to implement false positive filtering during HTTP authentication testing:

```bash

# Ignore standard 401 Unauthorized responses

patator http_fuzz url="http://10.0.0.1/login" \
    user_pass=COMBO00:COMBO01 \
    0=users.txt 1=pass.txt \
    -x ignore:code=401

```

```bash

# Ignore responses containing a specific error message

patator http_fuzz url="http://10.0.0.1/admin" \
    user_pass=COMBO00:COMBO01 \
    0=users.txt 1=pass.txt \
    -x ignore:fgrep='Login incorrect.'

```

```bash

# Force Patator to honor ignore rules even for failures (use with caution)

patator http_fuzz url="http://10.0.0.1/login" \
    user_pass=COMBO00:COMBO01 \
    0=users.txt 1=pass.txt \
    -x ignore:code=401 \
    --allow-ignore-failures

```

In the first example, any HTTP 401 response is treated as a non‑hit. The second example filters based on exact string matches in the response body. The third example demonstrates lifting the default safeguard, allowing the ignore rule to suppress failure logs entirely—an option that should be used only when the tester is certain that 401 responses represent expected failures rather than anomalies.

## Summary

- **Action filters** (`-x ignore`) provide granular control over which responses are excluded from hit reporting based on status codes, text patterns, or size.
- **Condition matching** in `Controller.lookup_actions` evaluates every HTTP response against user‑defined rules in real‑time.
- **Default safeguards** prevent accidental suppression of authentication failures unless the user explicitly passes `--allow-ignore-failures`.
- **Source code locations** for these mechanisms are concentrated in [`src/patator/patator.py`](https://github.com/lanjelot/patator/blob/main/src/patator/patator.py) within the `Controller` class methods and the `HTTP_fuzz` execution module.

## Frequently Asked Questions

### What constitutes a false positive during HTTP authentication brute‑forcing with Patator?

A false positive occurs when Patator reports a result as a successful authentication hit when the response is actually an expected error, such as a `401 Unauthorized` status code or a page containing "Login failed." The framework treats these as **ignore** candidates rather than valid credentials, preventing them from cluttering the output.

### How does the `-x ignore` action specifically prevent false positives?

The `-x ignore` action allows users to define conditions (e.g., `code=401`, `fgrep='Error'`) that identify predictable error responses. When `Controller.lookup_actions` matches a response against these conditions, it flags the result as ignored and prevents it from being emitted as a hit. This ensures that only responses failing to match error patterns are reported as potential successes.

### Why does Patator require the `--allow-ignore-failures` flag to ignore certain responses?

Patator defaults to **not** allowing ignore actions to suppress failure reports. This safeguard prevents testers from accidentally configuring ignore rules that mask genuine authentication failures or system anomalies. The `--allow-ignore-failures` flag explicitly overrides this protection, granting permission for ignore rules to suppress failure logging when the tester is confident that the filtered responses are benign.

### Where in the source code does Patator implement the false positive filtering logic?

The core logic resides in [`src/patator/patator.py`](https://github.com/lanjelot/patator/blob/main/src/patator/patator.py). The `Controller.update_actions` method (around line 1493) parses ignore rules, while `Controller.lookup_actions` (around line 1496) performs the response matching. The safety check that respects `--allow-ignore-failures` is implemented in `Controller.report_progress`, ensuring that failure suppression only occurs with explicit user consent.