Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Excluded scanner issue still showing up in report

Matthew | Last updated: Jan 02, 2018 06:08PM UTC

Using 1.7.30 Minor thing here... I excluded a bunch of individual scan issues and ran a scan. In the final results, I still had "Python code injection" showing up in the results of issue types, even though it was excluded.

Liam, PortSwigger Agent | Last updated: Jan 03, 2018 09:11AM UTC

We've done some testing switching the Python code injection test off and on, we haven't been able to replicate this issue. Are you able to replicate this issue consistently?

Burp User | Last updated: Jan 05, 2018 07:20AM UTC

Actually I'm experiencing the same thing -> I excluded python injection, but thanks to a slow environment at the moment of scanning, I got Python Code Injection: eval(compile('for x in range(1):\n import time\n time.sleep(20)','a','single'))

Liam, PortSwigger Agent | Last updated: Jan 05, 2018 09:02AM UTC

Matt, Andrej, would it be possible to send us a screenshot of your Scan Issues settings? If so, could you send them to support@portswigger.net. Thanks.

Burp User | Last updated: Jan 05, 2018 03:13PM UTC

This has happened with the few scans I've done now. I'm scanning a lot of URL's (about 2000 or more) and getting lots of issues that I'm looking for, but also a few Python issues even though it has been excluded.

Burp User | Last updated: Jan 08, 2018 03:50PM UTC

I've sent you the info requested. Also note that I also did another scan over the weekend with these scan issues and got Python and now PHP issues in the scan (PHP is also disabled).

PortSwigger Agent | Last updated: Jan 09, 2018 10:00AM UTC

Thanks for reporting this issue. The problem occurs if the insertion point you are scanning is vulnerable to both code injection and SQL injection. In addition, you must have unidentified code injection enabled to trigger the problem. We are working on a fix as we speak, and a new version will be released in a few days. In the meantime, you can work around the problem by disabling unknown code injection in your scanner configuration.

Burp User | Last updated: Jan 10, 2018 08:48AM UTC

Same for me, I just sent my email with more information. I have Ruby and Python injection (both time-based), even though they are both disabled.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.