Forum Discussion

imac_105647's avatar
imac_105647
Icon for Nimbostratus rankNimbostratus
Jul 08, 2010

Attack signature not triggered

Hello,     We had a visit from an attacker last night and ASM did not trigger on this URI:     /content/job-details.php?id=-49893%20UNION%20SELECT%20CHAR(97,102,56,56,48,48,55,53,97,97)--1...
app sec
BIG-IP Access Policy Manager (APM)
security
imac_105647's avatar
imac_105647
Icon for Nimbostratus rankNimbostratus
Jul 08, 2010
Hi Aaron,

 

 

Yes the signatures appear to be enabled both globally on the policy and on the wildcard parameter.

 

 

The ASM did not alert so there is not full request info page unfortunately. I only know about the attack because mod_security stepped in it's way.

 

 

I might try to modify the URI to get ASM to trigger for another metacharacter and see what happens then.

 

 

Ian