diff --git a/doc/README.sgml b/doc/README.sgml index 5b318f106..b5b7b65ea 100644 --- a/doc/README.sgml +++ b/doc/README.sgml @@ -851,7 +851,7 @@ Options: These options can be used to tweak testing of specific SQL injection techniques. - --technique=TECH SQL injection techniques to test for (default all) + --technique=TECH SQL injection techniques to test for (default BEUST) --time-sec=TIMESEC Seconds to delay the DBMS response (default 5) --union-cols=UCOLS Range of columns to test for UNION query SQL injection --union-char=UCHAR Character to use for bruteforcing number of columns diff --git a/lib/core/option.py b/lib/core/option.py index ff8106ef9..bc4785f55 100644 --- a/lib/core/option.py +++ b/lib/core/option.py @@ -607,9 +607,10 @@ def __setOS(): def __setTechnique(): validTechniques = getPublicTypeMembers(PAYLOAD.TECHNIQUE) - selTechniques = [] if conf.tech and isinstance(conf.tech, basestring): + selTechniques = [] + for t in conf.tech: if t.upper() not in ("B", "E", "U", "S", "T"): errMsg = "value for --technique must be a string composed " @@ -621,6 +622,7 @@ def __setTechnique(): if t.upper() == validTech[0]: selTechniques.append(validInt) break + conf.tech = selTechniques else: conf.tech = filter(lambda x: x in PAYLOAD.SQLINJECTION, [int(c) for c in str(conf.tech)])