topic Re: sql injection update signature in Network Security

sql injection update signature

josephium — Sun, 10 Mar 2019 11:17:56 GMT

hi,

we are currently comparing cisco ips to tippingpoint, i have a cisco ips in front and tippingpoint in the back, so we are checking if cisco ips is missing on a lot of stuff , and currently it is missing on SQL injection attacks and cross scripting, which seems to be the weak point in cisco ips, its missing a lot on sql injection signatures, i mean why a simple update/set command does not have a signature ?

Re: sql injection update signature

mhellman — Wed, 17 Sep 2008 13:45:59 GMT

Cisco just recently added some "generic SQL injection" signatures. Are you on the latest signature release? 5930-0 thru 5930-6 are the new ones. There is no update/set one though AFAICT. 5474-0 and 5474-1 are the only other signatures I'm aware of.

Re: sql injection update signature

josephium — Thu, 18 Sep 2008 08:35:11 GMT

Thank you for your reply, do you know how to get in contact with the ips signature engineers at Cisco , i would like to share my comparaison with them as well as an attack that is passing all sql injection signature containing update but with u%pdate and the sql database is interpreting it as a normal update.

Re: sql injection update signature

wsulym — Thu, 18 Sep 2008 10:59:45 GMT

Send us an email to ips-signature-team@cisco.com one of the signature developers will pick it up.