The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Option to turn off 'OR' based SQL injection tests

Sebastien | Last updated: May 03, 2018 06:40AM UTC

Hey, I noticed that the Burp Suite scanner uses 'OR' based SQL Injection tests by default, and that there is no option to disable this either. I was wondering if it would be possible to add an option in detection methods to separate these kinds of tests. (At least the OR based ones) The reason for this is that for some queries, these OR tests could potentially alter entire tables/databases if the query is modifying fields. For example: DELETE FROM posts WHERE id=2 If an OR test would succeed on this, it would delete all posts. Thanks

PortSwigger Agent | Last updated: May 03, 2018 09:12AM UTC