I am learning at school about attack signatures on web applications (basically OWASP), but I do not understand what they really are in this context. Can anybody give me some good references where I can better understand what they are and where they are used? Thanks!
Attack signatures in the context of network intrusion detection (especially in relation to web applications) are heuristics and data patterns that can be used to identify traffic that constitutes an attack.
For example, the regex pattern
union\s+select could be used to (albeit very naively) detect SQL injection attacks. Another pattern might simply be
0x31303235343830303536, which is a value that Havij (a SQL injection tool) uses in its requests.
Signatures don't have to be related to application data. They could also be based upon packet flags, patterns of traffic (e.g. lots of unexpected DNS response packets), bad login attempts, etc.
These signatures combined can form the backbone of an Intrusion Detection System (IDS), which relies upon these patterns and heuristics in order to identify attacks and alert the administrator.