Regex help for SQL update statement

DSmirnov — Sun, 10 Mar 2019 10:49:08 GMT

Hello,

need help from IPS regex guru - trying to build the signature to detect SQL update statement in HTTP requests.

1) Am I correct with regex below specified as Request-Regex?

[Uu][Pp][Dd][Aa][Tt][Ee]([%]20|[+])[\x20-\x7e]+[Ss][Ee][Tt]([%]20|[+])[\x20-\x7e]+=

2) How do I make sure that it detects 'Update' in URI and Arguments only and not in the body on entire webserver response (currently looks like the case)?

Re: Regex help for SQL update statement

mhellman — Thu, 04 Oct 2007 20:22:26 GMT

1) It looks correct to me

2) Typically, the "service HTTP" engine is used to inspect requests and the "TCP string" engine is used to inspect HTTP server responses. If you only want to inspect requests, use the service HTTP engine.

topic Regex help for SQL update statement in Network Security

Regex help for SQL update statement

Re: Regex help for SQL update statement