SQL Injection Attempt
Attack scenariohttp:exploitMITRE T1595.002
- Version
- 0.4
- Name
- crowdsecurity/http-sqli-probing
- Remediation
- Ban
A scenario that detects SQL injection probing with minimal false positives
Install with a top-level collection
16 collections include itsudo cscli collections install crowdsecurity/aws-cloudfrontInstalls 2 parsers and 47 scenarios, via HTTP - Generic Protection.
View AWS CloudFront →Installation
sudo cscli scenarios install crowdsecurity/http-sqli-probingThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
type: leaky#requires at least 2.0 because it's using the 'data' section and the 'Upper' expr helperformat: 2.0name: crowdsecurity/http-sqli-probbing-detectiondata:- source_url: https://hub-data.crowdsec.net/web/sqli_probe_patterns.txtdest_file: sqli_probe_patterns.txttype: stringdescription: "A scenario that detects SQL injection probing with minimal false positives"filter: "evt.Meta.log_type in ['http_access-log', 'http_error-log'] && any(File('sqli_probe_patterns.txt'), {Upper(evt.Parsed.http_args) contains Upper(#)})"groupby: evt.Meta.source_ipcapacity: 10leakspeed: 1sblackhole: 5m#low false positives approach : we require distinct payloads to avoid false positivesdistinct: evt.Parsed.http_argslabels:remediation: trueclassification:- attack.T1595.002behavior: "http:exploit"label: "SQL Injection Attempt"spoofable: 0service: httpconfidence: 3
Installed on
Know where it runs
Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.
Documentation
The http sqli probing scenario aims at detecting, with very little false positive chances, SQL injection probing attempts.
SQL injection probing attempts will be characterized by the presence of specific SQL-related patterns in uri/GET arguments (if and when this is where the injected parameter is), and this is what this scenario detects.
The word list is picked specifically to limit false positives.
Furthermore, a distinct directive is present on the get parameters themselves to reduce false positive chances.
You can test the behavior of the scenario by launching the excellent sqlmap on one of your pages.
WARNING This scenario is not a WAF, and this scenario does not aims at replacing a WAF. A motivated attacker with knowledge of crowdsec will be able to bypass it. It is mostly meant to be a way to detect generic SQL injection probing such as performed by open-source or commercial scanners.