diff --git a/lib/controller/checks.py b/lib/controller/checks.py index e4c597f8f..2476cd5ba 100644 --- a/lib/controller/checks.py +++ b/lib/controller/checks.py @@ -446,10 +446,19 @@ def checkSqlInjection(place, parameter, value): truePage = threadData.lastComparisonPage or "" if trueResult and not(truePage == falsePage and not kb.nullConnection): + # Perform the test's False request falseResult = Request.queryPage(genCmpPayload(), place, raise404=False) - # Perform the test's False request if not falseResult: + if kb.negativeLogic: + boundPayload = agent.prefixQuery(kb.data.randomStr, prefix, where, clause) + boundPayload = agent.suffixQuery(boundPayload, comment, suffix, where) + errorPayload = agent.payload(place, parameter, newValue=boundPayload, where=where) + + errorResult = Request.queryPage(errorPayload, place, raise404=False) + if errorResult: + continue + infoMsg = "%s parameter '%s' seems to be '%s' injectable " % (paramType, parameter, title) logger.info(infoMsg)