I am learning at school about attack signatures on web applications (basically OWASP), but I do not understand what they really are in this context. Can anybody give me some good references where I can better understand what they are and where they are used? Thanks!

closed as too broad by TildalWave, Adi, Ayrx, Scott Pack, Steve Jan 26 '14 at 20:46

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.


Attack signatures in the context of network intrusion detection (especially in relation to web applications) are heuristics and data patterns that can be used to identify traffic that constitutes an attack.

For example, the regex pattern union\s+select could be used to (albeit very naively) detect SQL injection attacks. Another pattern might simply be 0x31303235343830303536, which is a value that Havij (a SQL injection tool) uses in its requests.

Signatures don't have to be related to application data. They could also be based upon packet flags, patterns of traffic (e.g. lots of unexpected DNS response packets), bad login attempts, etc.

These signatures combined can form the backbone of an Intrusion Detection System (IDS), which relies upon these patterns and heuristics in order to identify attacks and alert the administrator.

  • Thank you very much for the explanation. Can you recommend me some books/articles/websites where I can get more details on this subject and maybe some simple (very simple) implementations? I've already googled this, but couldn't find something concrete. I guess I might have not searched the right thing properly. – user2435860 Jan 25 '14 at 10:57

Not the answer you're looking for? Browse other questions tagged or ask your own question.