update (now URIs like www.site.com/id82 are automatically treated as possible URI injectable)

lib/core/settings.py

@@ -217,3 +217,6 @@ UNICODE_ENCODING = "utf8"
 
 # Reference: http://www.w3.org/Protocols/HTTP/Object_Headers.html#uri
 URI_HTTP_HEADER = "URI"
+
+# Uri format which could be injectable (e.g. www.site.com/id82)
+URI_INJECTABLE_REGEX = r".*/([^\.*?]+)\Z"

lib/core/target.py

@@ -32,6 +32,7 @@ from lib.core.option import __setDBMS
 from lib.core.option import __setKnowledgeBaseAttributes
 from lib.core.session import resumeConfKb
 from lib.core.settings import UNICODE_ENCODING
+from lib.core.settings import URI_INJECTABLE_REGEX
 from lib.core.xmldump import dumper as xmldumper
 from lib.request.connect import Connect as Request
 
@@ -78,6 +79,9 @@ def __setRequestParams():
 
         conf.method = HTTPMETHOD.POST
 
+    if re.search(URI_INJECTABLE_REGEX, conf.url, re.I):
+        conf.url = "%s*" % conf.url
+
     if "*" in conf.url:
         conf.parameters[PLACE.URI] = conf.url
         conf.paramDict[PLACE.URI] = {}