Skip to content

Commit 4f939b5

Browse files
bdamelebdamele
committed
avoid false positive message when extensive heuristic check is performed following detection of boolean blind injection detection: do only heuristic DBMS fingerprint for DBMS specific tables
1 parent 4bbf168 commit 4f939b5

1 file changed

Lines changed: 4 additions & 1 deletion

File tree

‎lib/controller/checks.py‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -650,9 +650,12 @@ def heuristicCheckDbms(injection):
650650

651651
pushValue(kb.injection)
652652
kb.injection = injection
653-
randStr1, randStr2 = randomStr(), randomStr()
654653

655654
for dbms in getPublicTypeMembers(DBMS, True):
655+
if not FROM_DUMMY_TABLE.get(dbms, ""):
656+
continue
657+
658+
randStr1, randStr2 = randomStr(), randomStr()
656659
Backend.forceDbms(dbms)
657660

658661
if checkBooleanExpression("(SELECT '%s'%s)='%s'" % (randStr1, FROM_DUMMY_TABLE.get(dbms, ""), randStr1)):

0 commit comments

Comments
 (0)