diff --git a/lib/controller/checks.py b/lib/controller/checks.py index 768f79674..7d8243e10 100644 --- a/lib/controller/checks.py +++ b/lib/controller/checks.py @@ -744,10 +744,14 @@ def heuristicCheckSqlInjection(place, parameter): while '\'' not in randStr: randStr = randomStr(length=10, alphabet=HEURISTIC_CHECK_ALPHABET) + kb.heuristicMode = True + payload = "%s%s%s" % (prefix, randStr, suffix) payload = agent.payload(place, parameter, newValue=payload) page, _ = Request.queryPage(payload, place, content=True, raise404=False) + kb.heuristicMode = False + parseFilePaths(page) result = wasLastResponseDBMSError() diff --git a/lib/core/common.py b/lib/core/common.py old mode 100644 new mode 100755 index d581795fd..ec108eda3 --- a/lib/core/common.py +++ b/lib/core/common.py @@ -2880,7 +2880,7 @@ def removeReflectiveValues(content, payload, suppressWarning=False): regex = REFLECTED_REPLACEMENT_REGEX.join(parts[1:]) retVal = re.sub(r"(?i)\b%s\b" % regex, REFLECTED_VALUE_MARKER, retVal) - if retVal != content: + if retVal != content and not kb.heuristicMode: kb.reflectiveCounters[REFLECTIVE_COUNTER.HIT] += 1 if not suppressWarning: warnMsg = "reflective value(s) found and filtering out" diff --git a/lib/core/option.py b/lib/core/option.py index 526d35d30..951e83310 100644 --- a/lib/core/option.py +++ b/lib/core/option.py @@ -1599,6 +1599,7 @@ def _setKnowledgeBaseAttributes(flushAll=True): kb.forcedDbms = None kb.headersFp = {} kb.heuristicDbms = None + kb.heuristicMode = False kb.heuristicTest = None kb.hintValue = None kb.htmlFp = []