topic IPS module bypass in Network Security

IPS module bypass

ohassairi — Tue, 12 Mar 2019 04:20:26 GMT

hi experts

we are using cisco ips module in cico asa firewall 5520

the ips is working fine and it stops sql injections as seen from log

however, one coleague showed me how he can bypass the ips using one software that sends the username ‘ or 1=1 – encoded (url encoder/decoder)

is there any way to let the ips checks the username as clear text and also as encoded ?

thanks

To my knowledge this is not

Marius Gunnerud — Wed, 18 Jun 2014 08:14:18 GMT

To my knowledge this is not possible using IPS. IPS filters based on signatures from Cisco, manually configured signatures, traffic anomoly...etc. So the IPS does not check and authenticate users, devices, and does not do MAB which is authentication. For this you would need to have an ISE or similar user access control device.

You may also need to add exceptions to the IPS to allow the sql traffic as well...but then you may or may not want to also have user authentication in addition.

Please remember to select a correct answer and rate helpful posts

Hello, To fix that issue you

Juraj Papic — Wed, 18 Jun 2014 12:41:14 GMT

Hello,

To fix that issue you should check your sql configuration.

Regards