(
&self,
client: &reqwest::Client,
form: &Form,
true_payload: &str,
false_payload: &str,
param_index: usize,
pb: &ProgressBar,
)
| 350 | let true_response = if form.method.to_lowercase() == "post" { |
| 351 | client |
| 352 | .post(action_url.clone()) |
| 353 | .form(&true_form_data) |
| 354 | .send() |
| 355 | .await? |
| 356 | } else { |
| 357 | client |
| 358 | .get(action_url.clone()) |
| 359 | .query(&true_form_data) |
| 360 | .send() |
| 361 | .await? |
| 362 | }; |
| 363 | |
| 364 | if true_response.status() == reqwest::StatusCode::NOT_FOUND { |
| 365 | return Ok(false); |
| 366 | } |
| 367 | |
| 368 | self.rate_limiter.wait().await; |
| 369 | let false_response = if form.method.to_lowercase() == "post" { |
| 370 | client |
| 371 | .post(action_url) |
| 372 | .form(&false_form_data) |
| 373 | .send() |
| 374 | .await? |
| 375 | } else { |
| 376 | client |
| 377 | .get(action_url) |
| 378 | .query(&false_form_data) |
| 379 | .send() |
| 380 | .await? |
| 381 | }; |
| 382 | |
| 383 | pb.inc(2); |
| 384 | if false_response.status() == reqwest::StatusCode::NOT_FOUND { |
| 385 | return Ok(false); |
| 386 | } |
| 387 | |
| 388 | if let (Ok(true_body), Ok(false_body)) = |
| 389 | (true_response.text().await, false_response.text().await) |
| 390 | { |
| 391 | if true_body != false_body { |
| 392 | let vuln = SqlInjectionVulnerability { |
| 393 | url: form.url.clone(), |
| 394 | parameter: tested_param.clone(), |
| 395 | payload: format!("{} / {}", true_payload, false_payload), |
| 396 | vuln_type: "Boolean-Based".to_string(), |
| 397 | }; |
| 398 | return Ok(report_found("SQL Injection", &vuln.payload, &vuln.parameter, || { |
| 399 | self.reporter.report_sql_injection(&vuln); |
| 400 | })); |
| 401 | } |
| 402 | } |
| 403 | Ok(false) |
| 404 | } |
| 405 | |
| 406 | async fn measure_form_time( |
| 407 | &self, |
| 408 | client: &reqwest::Client, |
| 409 | form: &Form, |
no test coverage detected