Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 12:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Add a revised script for detecting HTTP SQL injection, deprecate original

Browse source
This commit is contained in:
Vern Paxson 2025-05-17 07:58:11 -07:00 • committed by Arne Welzel
parent 6b6c3dbbb7
commit dcd14f7a16
12 changed files with 217 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

1
testing/btest/scripts/policy/protocols/http/sql-injection-plus-dvwa.zeek
View file

@ -4,6 +4,7 @@
# @TEST-EXEC: btest-diff http.log.cut
@load base/protocols/http
# Remove in v8.1: Remove this test when detect-sqli is gone sql-injection-plus-dvwa2.zeek tests detect-sql-injection.
@load protocols/http/detect-sqli
event connection_state_remove(c: connection)

18
testing/btest/scripts/policy/protocols/http/sql-injection-plus-dvwa2.zeek Normal file
View file

@ -0,0 +1,18 @@
# A version of sql-injection-plus-dvwa.zeek that uses its replacement script.
#
# @TEST-EXEC: zeek -C -r $TRACES/http/cooper-grill-dvwa.pcapng -b %INPUT >output
# @TEST-EXEC: btest-diff output
# @TEST-EXEC: btest-diff notice.log
# @TEST-EXEC: zeek-cut -m uid method host uri tags < http.log > http.log.cut
# @TEST-EXEC: btest-diff http.log.cut
@load base/protocols/http
@load protocols/http/detect-sql-injection
redef HTTP::sqli_requests_threshold = 3;
event connection_state_remove(c: connection)
{
if ( c?$http )
print c$uid, c$id, cat(c$http$tags);
}