Forum Discussion

imac_105647's avatar
imac_105647
Icon for Nimbostratus rankNimbostratus
Jul 08, 2010

Attack signature not triggered

Hello,

 

 

We had a visit from an attacker last night and ASM did not trigger on this URI:

 

 

/content/job-details.php?id=-49893%20UNION%20SELECT%20CHAR(97,102,56,56,48,48,55,53,97,97)--1040

 

 

I see there is a UNION SELECT SQL Injection attack signature that seems to be active for the policy in place for this website, but the attack did not trigger it.

 

 

Any idea why that might be the case?

 

 

Incidentally we also run mod_security and that blocked the attack.

 

 

Thanks, Ian

 

APM
app sec
security

7 Replies

Sort By
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Jul 08, 2010
    Hi Ian,

     

     

    I tried testing with a parameter value set to -49893%20UNION%20SELECT%20CHAR(97,102,56,56,48,48,55,53,97,97)--1040 and see two signatures triggered:

     

     

    SQL-INJ "UNION SELECT" (Parameter) 200000073

     

    SQL-INJ CHAR() 200002270

     

     

    Can you confirm these two signatures are enabled in your policy under the Attack Signatures | Policy Attack Signatures? If so, are they still enabled on the id or global * parameter? Does the parameter that the request matched have checks enabled?

     

     

    If you want to email me the full request info page, I can take a quick look today.

     

     

    Aaron
  • imac_105647's avatar
    imac_105647
    Icon for Nimbostratus rankNimbostratus
    Jul 08, 2010
    Hi Aaron,

     

     

    Yes the signatures appear to be enabled both globally on the policy and on the wildcard parameter.

     

     

    The ASM did not alert so there is not full request info page unfortunately. I only know about the attack because mod_security stepped in it's way.

     

     

    I might try to modify the URI to get ASM to trigger for another metacharacter and see what happens then.

     

     

    Ian

     

  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Jul 08, 2010
    Sorry, that would only have worked if you were logging all requests. You could also append a query string parameter with a ' or some other metacharacter that is marked as illegal to trigger a violation.

     

     

    Aaron
  • imac_105647's avatar
    imac_105647
    Icon for Nimbostratus rankNimbostratus
    Jul 08, 2010
    Odder and odder,

     

     

    Some of my tests have triggered the ASM now, I've sent the full request text for one of those.

     

     

    Ian

     

  • imac_105647's avatar
    imac_105647
    Icon for Nimbostratus rankNimbostratus
    Jul 08, 2010
    I think it is something to do with staging the policy is new and the signatures are show as "In staging since 08/07/2010" does this affect what they do?

     

  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Jul 08, 2010
    Staging allows you to make changes to the policy (generally tightening it) and put the changes in transparent mode. If you have staging enabled (under Policy | Staging-Tightening Period) and update the attack sigs, modified and new signatures will be put in staging until you manually enable them.

     

     

    Aaron
  • imac_105647's avatar
    imac_105647
    Icon for Nimbostratus rankNimbostratus
    Jul 08, 2010
    Yes that is what it was, I've turned staging off and re-ran the query and the ASM alerts. Thanks for your help, sorry to bother you,

     

     

    Ian