Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge remote-tracking branch 'origin/topic/vern/http-sqli-replacement'

Browse source 
* origin/topic/vern/http-sqli-replacement:
  site/local: Switch to detect-sql-injection
  Add a revised script for detecting HTTP SQL injection, deprecate original
This commit is contained in:
Arne Welzel 2025-05-20 16:25:58 +02:00
commit 906b91dca8
15 changed files with 224 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

12
NEWS
View file

@ -53,6 +53,18 @@ Removed Functionality
Deprecated Functionality
------------------------
- The ``protocols/http/detect-sqli.zeek`` script has been deprecated in favor of a
new ``protocols/http/detect-sql-injection.zeek`` script to switch from the victim
host being placed into the ``src`` field of a notice to instead use ``dst``.
The attacker host is now placed into ``src``. Further, notices hold the first
sampled connection uid.
Note that the ``Notice::Type`` enumeration names remain the same. You can determine
which script was used by the presence of populated ``uid`` and ``dst`` fields in the
``notice.log`` entries.
The replacement script doesn't populate the ``email_body_sections`` anymore either.
Zeek 7.2.0
==========