WAF and HIPS detect SQL injection based on rules.

For example 1" OR 1=1 --

Both devices will block it.

How about `1" OR 300+1-300+0=50+57-6 -- ?

In my scenario HIPS doesn't seem to be able detect SQL injection inputted in form fields but yet able to detect SQL injection passed in URLs.

WAF should be able to detect both types of SQL injection.

Is it because URLs and form fields are on different layers? HIPS is on network layer whereas WAF is on application layer that's why able to detect both form based and url injection or because the 300+1-300 query doesn't match the rule.

So question is can HIPS actually detect Form based SQL injection? If no why? If yes I would assume it's the HIPS inability or misconfiguration.

  • 2
    I never use 1=1. I always use 2=2 and then try foo=foo. A shocking number of filters let that pass. – schroeder Feb 1 '18 at 12:28
  • For reference, see security.stackexchange.com/questions/10483/… – AndyMac Feb 1 '18 at 13:40
  • I would suggest a rephrase of your question: "The HIPS I'm testing does not inspect the HTTP data. Why?" That way, you can inspect your assumptions and confirm some hypotheses. Which HIPS? How is it configured? Does it inspect any payload data? The edit to the question seems more like an X/Y problem. – schroeder Feb 1 '18 at 14:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.