WAF and HIPS detect SQL injection based on rules.

For example 1" OR 1=1 --

Both devices will block it.

How about `1" OR 300+1-300+0=50+57-6 -- ?

In my scenario HIPS doesn't seem to be able detect SQL injection inputted in form fields but yet able to detect SQL injection passed in URLs.

WAF should be able to detect both types of SQL injection.

Is it because URLs and form fields are on different layers? HIPS is on network layer whereas WAF is on application layer that's why able to detect both form based and url injection or because the 300+1-300 query doesn't match the rule.

So question is can HIPS actually detect Form based SQL injection? If no why? If yes I would assume it's the HIPS inability or misconfiguration.

  • 3
    I never use 1=1. I always use 2=2 and then try foo=foo. A shocking number of filters let that pass.
    – schroeder
    Commented Feb 1, 2018 at 12:28
  • For reference, see security.stackexchange.com/questions/10483/…
    – AndyMac
    Commented Feb 1, 2018 at 13:40
  • I would suggest a rephrase of your question: "The HIPS I'm testing does not inspect the HTTP data. Why?" That way, you can inspect your assumptions and confirm some hypotheses. Which HIPS? How is it configured? Does it inspect any payload data? The edit to the question seems more like an X/Y problem.
    – schroeder
    Commented Feb 1, 2018 at 14:17
  • @schroeder I guess testing all fields with ' OR 2=2 -- is also better than just ' OR '2'='2? If we use a comment, shouldn't we use a semicolon before the comment, e.g. ' OR 2=2;--?
    – baptx
    Commented Jan 22, 2020 at 17:16
  • 1
    @baptx that's entirely up to your target
    – schroeder
    Commented Jan 22, 2020 at 17:48


You must log in to answer this question.

Browse other questions tagged .