We all know it is nearly impossible to produce a large website without one or two flaws. As such I’ve written a small monitor that checks Apache access logs for potential SQL injection attacks (amongst other things), and it’s working very well. I get an alert whenever someone attempts an attack, and I’ve had so few false positives that the default action is now to dump them into an iptables drop list. It’s even helped me identify a few (non-security) bugs and remove them.
Here’s my rules (case insensitive):
PathInjection = \./\.\./(bin|boot|data|dev|etc|home|lib|lib64|media|mnt|opt|proc|root|sbin|selinux|srv|sys|tmp|usr|var)/ Havij = 0x31303235343830303536 r3dm0v3 = 0x7233646D3076335F68766A5F696E6A656374696F6E LogicBypass = '.*?(\bor|\band|\bxor|\|\||\&\&).*?-- UnionSelect = union[^a-z-_]+((all|distinct)[^a-z-_]+)?select[^a-z-_]
What I’d like to know is, how would you bypass these checks and still produce a valid injection? Can you think of a way to improve them without introducing false positives?
A few notes:
- Case sensitivity is switched off.
- I’m using MySQL.
- The Havij and r3dm0v3 entries are used as a catch-all to prevent use of those automation tools.
- I’m checking both raw and urldecoded strings.
- I’m not looking for answers like “make more secure code instead”.
- I’m not looking for a different way to do this, just a way to improve my current logic.
Ok, so people seem to have misunderstood my intent. That’s probably my fault, since I didn’t fully explain. This is being requested as a tacked-on feature to a monitoring product, and is designed to offer minimal security monitoring. As part of our dialog with the client and our documentation, we’re emphasising that this is not a catch-all, nor is it a replacement for proper security infrastructure (e.g. an IDS and firewall). It’s simply an informational service to help provide basic threat detection and produce statistics about the number of potential attacks. I’m not trying to write an IDS or firewall. If it were up to me, I’d leave the feature out and tell them to go install a full suite of security infrastructure with its own monitoring systems, but this isn’t my call. The current situation is that I’ve been testing the system on my own site. Right now, I’m just looking for a way to improve the regex strings to make this more effective. Hopefully this clears things up a little.
You’re talking about writing an IDS. Unless your product is an IDS, just get and install one. Snort is well-known and has a free version.
I’m not looking for a different way to do this, just a way to improve my current logic.
Sometimes when it comes to security, the wrong approach simply is. How would I mess with your current logic? Unicode or hex encoding.
Can you think of a way to improve them without introducing false positives?
I wouldn’t think of improving this silly approach at all. I’d rather improve the site security itself.
We all know it is nearly impossible to produce a large website without one or two flaws.
I disagree with that. At least for SQL injections. Injections are quite silly thing and protection is not a big deal.
sql injection is top rated web Application attack these days. There are many insecure code over the net and also there are several ways to protect application from sql injection attacks. sql injection can occur when an application uses input to construct dynamic sql statements or when it uses stored procedures to connect to the database. Methods of sql injection exploitation are classified according to the DBMS type and exploitation conditions Vulnerable request can implement Insert, update, delete. It is possible to inject sql code into any part of sql request Blind sql injection Features of sql implementations used in various dbms. Successful sql injection attacks enable attackers to execute commands in an application’s database and also take over the server.
- Basically, make sure your web server is up-to-date with latest security fixes/patches.
- Make sure you have filter every user input and output as proper encoding like UTF-8.
Read the full testing guide: https://www.owasp.org/images/8/89/OWASP_Testing_Guide_V3.pdf
- try tom imlement web application scanner , check this link http://trac.ush.it/ush/wiki/SecurityTools
- I do ex. watchfile now IBM aapscan tools http://www-01.ibm.com/software/rational/offerings/websecurity/ to scan all my web application
check google more how to protect against sql injection