diff --git a/lib/request/basic.py b/lib/request/basic.py index 1b5f1a8a4..2bf8a8b80 100644 --- a/lib/request/basic.py +++ b/lib/request/basic.py @@ -68,13 +68,13 @@ def parseResponse(page, headers): # Detect injectable page absolute system path # NOTE: this regular expression works if the remote web application # is written in PHP and debug/error messages are enabled. - absFilePathsRegExp = ( r" in (.*?) on line", r"\b[A-Za-z]:(\\[\w.\\]*)?", r"/[/\w.]+" ) + absFilePathsRegExp = ( r" in (?P.*?) on line", r"\b(?P[A-Za-z]:(\\[\w.\\]*)?)", r"(\A|[^<])(?P/[/\w.]+)" ) for absFilePathRegExp in absFilePathsRegExp: reobj = re.compile(absFilePathRegExp) for match in reobj.finditer(page): - absFilePath = match.group() + absFilePath = match.group("result") if absFilePath not in kb.absFilePaths: kb.absFilePaths.add(os.path.dirname(absFilePath))