SQL injection recon detection

Unanswered Question
Jul 7th, 2008
User Badges:
  • Blue, 1500 points or more

Why are there no vendor provided signatures that detect SQL injection reconnaissance? I recently did an internal pen test and it reminded me again of this deficiency. I've been meaning to write my own for the longest time, but frankly...why should I need to? It is simply amazing to me that I can throw standard SQL injection tests at a web app and our network IDS is "blind" to them.


http://ha.ckers.org/sqlinjection/

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 2.1 (8 ratings)
Loading.
attmidsteam Mon, 07/07/2008 - 11:04
User Badges:
  • Silver, 250 points or more

Join the club. :-) I got fed up too and am writing all my own for detecting excessive SELECTs, INSERTs/UPDATEs/DELETEs etc but with obfuscation the task becomes very difficult. This really needs to happen within the http-server engine but I'm using multi-string because I wanted a list of keywords in a certain order.


See also: http://isc.sans.org/diary.html?storyid=4565

TradeSecrets Fri, 07/11/2008 - 06:50
User Badges:
  • Bronze, 100 points or more

Hi there,


The days of IDS are coming to an end. I know IPS is expensive, but they are well worth the price.


Below are a few SQL signatures you can add to a SNORT IDS or some other IDS.


|90909090|

|04010101010101|

--'|22|'


Let me know if that helps.

~TS

attmidsteam Fri, 07/11/2008 - 06:57
User Badges:
  • Silver, 250 points or more

All I saw posted were 3 small strings which WOULD not protect against SQL injections, sorry (and would trigger some massive false positives).


An IPS is the same thing as an IDS but with the 'magic' buzzword of being inline. The same pattern based technology is still being utilized.

mhellman Fri, 07/11/2008 - 07:05
User Badges:
  • Blue, 1500 points or more

agreed. In the vast majority of cases, IDS isn't "good enough" to be IPS. For me, IPS is policy/security enforcement and belongs on a firewall. IDS is policy/security monitoring, which doesn't necessarily need to be inline.


back to the topic...I'm not really looking at detecting/preventing [insert flavor of the day] SQL injection worm. I'm looking at detecting a user using the typical patterns used to test for SQL vulnerabilities. They will almost certainly be easy to evade, but we do what we can.

mzeiser Fri, 07/11/2008 - 07:23
User Badges:
  • Cisco Employee,

We're working on improved coverage for SQL injection attacks.


Martin

IPS Signature Team

mhellman Fri, 07/11/2008 - 07:31
User Badges:
  • Blue, 1500 points or more

That would be awesome. Do you mean, "we're thinking about it" or, "we're sorting out the proper engines and regex's to use now"?? ;-)

mzeiser Fri, 07/11/2008 - 07:40
User Badges:
  • Cisco Employee,

It means "We're sorting out the proper engines and regex's to use".

SQL injection is quite a problem to catch though, as you basically hand something like source code to an interpreter, which means an attack can be encoded and vary in a thousand different ways. As we do try to create intelligent signatures, instead of simply hunting for fixed and most often easily change strings in a stream, this makes writing signatures for sql injection attacks kind of hard.

TradeSecrets Fri, 07/11/2008 - 07:35
User Badges:
  • Bronze, 100 points or more

Don't be sorry. It doesn't sound like you have a clue what you are taking about anyways. These signatures were pulled from a leading IPS vendors device. Just so you know IPS and IDS are not the same thing. Can I take your star away...

oH whoops.

mhellman Fri, 07/11/2008 - 07:46
User Badges:
  • Blue, 1500 points or more

Let's not get into a squabble about IDS versus IPS, they're market driven terms that mean different things to different people.


You don't provide any context for the regex you provided. What is it specifically designed to detect/protect? It looks like Snort regex, is it? Why not post the whole rule to give some context? I need more than just a regex to create a useful signature.

attmidsteam Fri, 07/11/2008 - 08:42
User Badges:
  • Silver, 250 points or more

TradeSecrets:


Please provide the full signature so we can discuss it.

christianz Wed, 07/16/2008 - 06:59
User Badges:

I agree in the sense that the SQL Signature set of ASA IPS is a bit poor. If it can help someone, I've wrote my oun signature in order to catch an attacker. It's working fine, and I think that is easy to modify.


-------------------

signatures 60000 0

alert-severity medium

sig-fidelity-rating 75

sig-description

sig-name CHZ SQL Injection

sig-string-info CHZ SQL Injection

sig-comment SQL Injection written by CHZ

exit

engine string-tcp

event-action produce-alert|deny-packet-inline|reset-tcp-connection

regex-string ([Dd][Ee][Cc][Ll][Aa][Rr][Ee])\%20\@.\%20([Vv][Aa][Rr][Cc][Hh][Aa][Rr])(.*);([Ss][Ee][Tt])\%20\@.=([Cc][Aa][Ss][Tt])

service-ports #WEBPORTS

exit

alert-frequency

summary-mode summarize

exit

exit

status

enabled true

exit

specify-mars-category yes

mars-category DoS/WebServer

exit

exit

-------------------


Best Regards


Chz

Actions

This Discussion