diff --git a/lib/core/common.py b/lib/core/common.py index 672bbd2db..1c44c4fd1 100644 --- a/lib/core/common.py +++ b/lib/core/common.py @@ -1262,11 +1262,11 @@ def getGoodSamaritanParameters(part, prevValue, originalCharset): predictedCharset.append(ordChar) predictedCharset.sort() - - if len(predictedCharset) > 1: - singleValue = None - return singleValue, predictedCharset, otherCharset + if len(predictedCharset) > 1: + return None, predictedCharset, otherCharset + else: + return singleValue, None, originalCharset else: return None, None, originalCharset diff --git a/lib/techniques/blind/inference.py b/lib/techniques/blind/inference.py index ab4ac3d27..1772aa5e5 100644 --- a/lib/techniques/blind/inference.py +++ b/lib/techniques/blind/inference.py @@ -371,13 +371,18 @@ def bisection(payload, expression, length=None, charsetType=None, firstChar=None if conf.useCommonPrediction: singleValue, predictedCharset, otherCharset = getGoodSamaritanParameters(kb.partRun, finalValue, asciiTbl) + val = None + if singleValue is None: val = getChar(index, predictedCharset, False) if predictedCharset else None else: - ##check if that's the value - #finalValue = singleValue - #break + #forgedPayload = safeStringFormat('AND (%s) = \'%s\'', (expressionUnescaped, singleValue)) + #result = Request.queryPage(urlencode(forgedPayload)) + #if result: + # finalValue = singleValue + # break pass + if not val: val = getChar(index, otherCharset) else: