Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Burp Active Scanner in Normal mode misses trivial Postgresql SQL Injection

Ryan | Last updated: Sep 21, 2016 02:40PM UTC

Hi, Burp Active Scanner in 'normal' mode misses trivial Postgresql SQL Injection such as the following: https://www.example.com/x?a=10;SELECT+PG_SLEEP(5)+-- Changing the 'scan speed' option to 'thorough' and the 'scan accuracy' to 'minimize false negatives' does detect the issue, however, it detects it as 'tentative'; by using a single quote and then matching the following string in the response "unterminated quoted string". I believe that Burp should use the "SELECT+PG_SLEEP(5)" payload in the 'normal' scan mode. Burp uses similar SQLi payloads for other DBMS in the 'normal' mode, so why not for Postgresql? Using this payload it will also be able to set the confidence to 'certain' rather than 'tentative'. Ryan

David | Last updated: Nov 10, 2021 10:55AM UTC

Looks like support for time-based detection of SQLi in Postgresql still hasn't been added to Burp's scanner, I replicated this by scanning the trackingId insertion point on https://portswigger.net/web-security/sql-injection/blind/lab-time-delays with the following configuration: Audit speed: Thorough Audit accuracy: Minimize false negatives Issues reported: SQL injection (all detection methods enabled) The scan completed with 50 requests but no findings, and looking through the log of requests sent it appears it's trying with time-based payloads for MySQL and SQL server, but not for Postgresql or Oracle. Is there any plan to add this capability to Burp's scanner, or a specific reason why these tests are excluded?

Liam, PortSwigger Agent | Last updated: Nov 10, 2021 12:44PM UTC

Thanks for your message. I've passed your suggestion to our Research team, we'll get back to you with their feedback.

Liam, PortSwigger Agent | Last updated: Nov 11, 2021 09:54AM UTC

We still have this story logged in our dev backlog. I've added your request to the development ticket. Thanks!

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.