取消布尔类 sql 注入检测；只保留启发式报错检测

yhy0 · May 24, 2024 · 6e2c347 · 6e2c347
1 parent 6b7dd16
commit 6e2c347
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 3 deletions.
diff --git a/conf/file.go b/conf/file.go
@@ -211,6 +211,7 @@ collection:
     - appid
     - appSecret
     - app_secret
+    - corpSecret
     - secret
     - auth
     - oauth

diff --git a/scan/PerFile/sql/heuristic.go b/scan/PerFile/sql/heuristic.go
@@ -179,9 +179,10 @@ func (sql *Sqlmap) HeuristicCheckSqlInjection() {
         return
     }
 
-    for _, pos := range injectableParamsPos {
-        sql.checkSqlInjection(pos)
-    }
+    // 不进行以下检测了，目前没什么收益，减少发包，等优化吧，
+    // for _, pos := range injectableParamsPos {
+    //     sql.checkSqlInjection(pos)
+    // }
 }
 
 func (sql *Sqlmap) checkSqlInjection(pos int) {