[weibalangzi]

Summary

• Phase SSTI probes previously treated reflection of 7*7 → 49 as confirmation via grep -qE '(\\b49\\b|7777777)'.
• That pattern false-positives on ordinary page content (CSS values, durations, IDs, etc.) and on reflected-but-unevaluated payloads.
• Switch payloads to a unique math canary (739391*739391 → 546699042881).
• Fetch an uninjected baseline first; skip URLs whose baseline already contains the canary, and only confirm when the canary appears after injection.

Test plan

• bash -n bughunter/tools/vuln_scanner.sh
• On a benign page that contains 49 in HTML/CSS, confirm Check 4 no longer reports [SSTI-CONFIRMED]
• On a known SSTI lab/endpoint (if available), confirm the unique canary still triggers [SSTI-CONFIRMED]
• Baseline skip path: if a URL body already contains 546699042881, the URL is skipped without confirmation

Made with Cursor