SQL injection

josephium · ‎06-03-2008

Hi, in the cisco IPS there is only 2 signatures that detect SQL in http request, checking a certain select ... from statement, but there are a lot more SQL injection technigues using the Drop or the insert, checking also the (') ... why is there not much more signatures about SQL injection ? what is the best way to do them manually ?

Thank you

mhellman · ‎06-03-2008

The Cisco sigs are just too generic and trigger on regular HTML all the time. You might think about creating rules that look for the typical tests that an attacker (or pen tester) would use to find SQL injection vulns. i.e. the precursor to the actual SELECT,INSERT,DROP,WHATEVER.

http://ha.ckers.org/sqlinjection/