Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Add a revised script for detecting HTTP SQL injection, deprecate original

Browse source
This commit is contained in:
Vern Paxson 2025-05-17 07:58:11 -07:00 • committed by Arne Welzel
parent 6b6c3dbbb7
commit dcd14f7a16
12 changed files with 217 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

15
scripts/policy/protocols/http/detect-sqli.zeek
View file

@ -1,5 +1,20 @@
##! SQL injection attack detection in HTTP.
## This package is deprecated in favor of detect-sql-injection.zeek.
##
## The replacement script annotates the notices it generates with
## an associated $uid connection identifier; always provides an attacker
## IP address in the $src field; and always provides a victim IP address
## in the $dst field. The notices generated by this script, on the other
## hand, lack a $uid identifier, and do not provide $dst information.
## In addition, for SQL_Injection_Victim notices, this script provides the
## victim's IP address in the $src field, which some find counter-intuitive.
##
## In addition, the replacement script removes support for generating
## Notice emails.
@deprecated "Remove in v8.1: Switch to the improved detect-sql-injection script"
@load base/frameworks/notice
@load base/frameworks/sumstats
@load base/protocols/http