Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge branch 'sqli-spaces-encode-to-plus' of https://github.com/cooper-grill/zeek

Browse source 
* 'sqli-spaces-encode-to-plus' of https://github.com/cooper-grill/zeek:
  account for spaces encoding to plus signs in sqli regex detection
This commit is contained in:
Arne Welzel 2024-10-29 14:05:54 +01:00
commit 5200b84fb3
8 changed files with 24 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

2
testing/btest/scripts/policy/protocols/http/test-sql-injection-regex.zeek
View file

@ -37,6 +37,8 @@ event zeek_init()
add positive_matches["/index.php?id=22 /*!49999 and 1=2*/-- and 1=1"];
add positive_matches["/index.php?ID=59 and (select count(table_name) from user_tables)>0 and 1=1"];
add positive_matches["/index.php?ID=60 and exists (select * from [news])"];
add positive_matches["?id=1'+OR+'1'='1"];
add positive_matches["?id=1'+UNION+SELECT+NULL,+version()+#"];
# These are not detected currently.
#add positive_matches["/index.asp?ARF_ID=(1/(1-(asc(mid(now(),18,1))\(2^7) mod 2)))"];