diff --git a/lib/controller/checks.py b/lib/controller/checks.py index 83cf6247b..a5a817d1a 100644 --- a/lib/controller/checks.py +++ b/lib/controller/checks.py @@ -379,7 +379,7 @@ def checkSqlInjection(place, parameter, value): if not injectable and not any((conf.string, conf.notString, conf.regexp)) and kb.pageStable: trueSet = set(extractTextTagContent(truePage)) falseSet = set(extractTextTagContent(falsePage)) - candidates = filter(None, (_.strip() if _.strip() in (kb.pageTemplate or "") and _.strip() not in falsePage else None for _ in (trueSet - falseSet))) + candidates = filter(None, (_.strip() if _.strip() in (kb.pageTemplate or "") and _.strip() not in falsePage and _.strip() not in threadData.lastComparisonHeaders else None for _ in (trueSet - falseSet))) if candidates: conf.string = candidates[0] infoMsg = "%s parameter '%s' seems to be '%s' injectable (with --string=\"%s\")" % (place, parameter, title, repr(conf.string).lstrip('u').strip("'")) diff --git a/lib/core/threads.py b/lib/core/threads.py index 015e2c312..849da683f 100644 --- a/lib/core/threads.py +++ b/lib/core/threads.py @@ -42,6 +42,7 @@ class _ThreadData(threading.local): self.hashDBCursor = None self.inTransaction = False self.lastComparisonPage = None + self.lastComparisonHeaders = None self.lastErrorPage = None self.lastHTTPError = None self.lastRedirectMsg = None diff --git a/lib/request/comparison.py b/lib/request/comparison.py index fe00054ea..f5ac9f2d4 100644 --- a/lib/request/comparison.py +++ b/lib/request/comparison.py @@ -47,6 +47,7 @@ def _comparison(page, headers, code, getRatioValue, pageLength): threadData = getCurrentThreadData() if kb.testMode: + threadData.lastComparisonHeaders = listToStrValue(headers.headers) if headers else "" threadData.lastComparisonPage = page if page is None and pageLength is None: @@ -56,7 +57,7 @@ def _comparison(page, headers, code, getRatioValue, pageLength): seqMatcher.set_seq1(kb.pageTemplate) if any((conf.string, conf.notString, conf.regexp)): - rawResponse = "%s%s" % (listToStrValue(headers.headers if headers else ""), page) + rawResponse = "%s%s" % (listToStrValue(headers.headers) if headers else "", page) # String to match in page when the query is True and/or valid if conf.string: