Tag Info

New answers tagged

1

Regular expressions are of very limited use here as any attack delivered via a HTTP POST request is unlikely to get logged. There are also many examples of header values having an impact while not being logged, ie: shellshock. There will also be alot of noise from automated scanners like Nikto that have no impact unless the visited url exist and is ...


5

The best solution would be to implicitly deny, i.e. allow exactly the data you want, but no other. You could write regexps matching all input that's not according to your filter to find any odd input, that might be an exploit. It is also a good way to find valid input you omitted in your regex. A username might be fine with [a-zA-Z0-9]+, rather than ...



Top 50 recent answers are included