Skip to main content
174 votes
Accepted

Is it possible to detect 100% of SQLi with a simple regex?

Keyword filtering for SQLi is not a good technique. There are too many ways to bypass it. Crazy things like sel/**/ect might work, for instance. Or playing games with substr(). And then there's EXEC('...
schroeder's user avatar
  • 131k
108 votes

Is it possible to detect 100% of SQLi with a simple regex?

NO Since every SQL injection is (by definition) valid SQL and since SQL is a context-free language (source), there is (again, by definition) no regex capable of matching an SQL injection, and trying ...
Sefa's user avatar
  • 1,754
59 votes

Is it possible to detect 100% of SQLi with a simple regex?

Technically, this is completely possible (though doing so also renders the database useless): .+ Will indeed detect any possible SQLi. However, it will also detect any attempt to do normal queries(...
Fake Name's user avatar
  • 927
24 votes

Is it possible to detect 100% of SQLi with a simple regex?

I'm wondering if it is possible to detect 100% of the possible SQLi attacks using a simple regex. The very fact that you're asking the question this way shows you're thinking about the problem ...
Daniel Pryden's user avatar
20 votes
Accepted

Reduce Noise when Penetration Testing

You want to increase signal and reduce noise during a pen test? Great! Here are some things to ponder on: For answers to the questions you have -- are they already answered somewhere else? For ...
atdre's user avatar
  • 19.1k
13 votes

Reduce Noise when Penetration Testing

You have to make a choice: are you going for stealth, or for broad coverage and efficiency? Essentially all scanning tools, including nmap -sS, are easily detected by a competent SOC if run at a ...
David's user avatar
  • 16.1k
11 votes

How much traffic can a firewall node handle? Any real examples?

Having done tests for multiple clients where they claim "scans won't knock this over, you'll be alright", then an hour later we're having a meeting discussing how they're going to handle a serious ...
Polynomial's user avatar
  • 135k
11 votes

Is it possible to detect 100% of SQLi with a simple regex?

No. First of all, there are several evil things you can do with SQL injections which don't require the use of the SELECT keyword, like the infamous universal password ' OR '1' = '1 or the common ...
Philipp's user avatar
  • 49.4k
9 votes
Accepted

How can the nmap tool be used to evade a firewall/IDS?

There are various ways that comes handy with nmap to evade the basic Firewall rules or Intrusion Detection Systems (IDS). Packet Fragmentation: This option evade pattern matching detection technique....
Scissor's user avatar
  • 106
9 votes
Accepted

HIDS - Choosing between regular OSSEC or Wazuh fork

Regarding Wazuh differences with OSSEC, the Wazuh team is working on updating the documentation to explain those better (and on a new release and installers). Wazuh new version (2.0, currently found ...
snaow's user avatar
  • 106
7 votes
Accepted

How to connect a Raspberry Pi IDS to the home router to detect intrusions network wide?

If you want to passively monitor the whole network a monitor port on the router or similar would be sufficient - although most common home routers (the ones with WLAN and cable/DSL modem in it) don't ...
Steffen Ullrich's user avatar
6 votes

How does advanced firewall scan data (check for signature etc) if it is encrypted?

For actually applying signatures to the decrypted traffic the firewall needs to have access to this traffic. The typical way to do this is by essentially doing a man in the middle attack, only that ...
Steffen Ullrich's user avatar
6 votes
Accepted

Benefit of using two network interfaces for intrusion detection system

The main benefit is speed. IDS isnt about prevention but rather about detection, so the packets that are routed to the production machine can be sent directly while the second port can mirror the ...
CaffeineAddiction's user avatar
5 votes
Accepted

Is all Snort community rules available in Snort registered rules?

Is all snort community rules available in snort registered rules ? Yes. snort Registered ruleset contains the Community ruleset. Ref or shall I include registered rules only in my snort? It ...
rootkea's user avatar
  • 166
5 votes
Accepted

Do NOP sleds expose shellcode?

IDSs will look for nop sleds, but they can also be masked. Consider that any instruction that is: Valid and executable Will continue execution somewhere in the nop sled between itself and the ...
Tim's user avatar
  • 118
5 votes

HIDS - Choosing between regular OSSEC or Wazuh fork

Although my opinion is probably biased here (I am part of the Wazuh team), here is an update on the differences between OSSEC and Wazuh: Scalability and reliability • Cluster support for managers ...
Santiago Bassett's user avatar
5 votes

Question about IDS and IPS

First of all, let's look at definitions for IPS and IDS: IDS: An intrusion detection system (IDS) is a device or software application that monitors a network or systems for malicious activity or ...
Tom K.'s user avatar
  • 7,966
5 votes
Accepted

Examples of non signature based anti-malware/anti-virus programs, IDS, & system integrity scanners

While I will answer your questions to the best of my abilities, please realize that any of the tools listed here require moderate to heavy configuration and a good understanding of systems security. ...
forest's user avatar
  • 66.9k
5 votes

Benefit of using two network interfaces for intrusion detection system

It is generally recommended that the administration of a security device (IDS, firewall) should be done using a network you can trust as much as possible. One can assume that the network where the IDS ...
Steffen Ullrich's user avatar
4 votes

Could encryption become a security breach?

IMHO these are two separate things. IDS and FW protects on different layers and if you do not have layered security on your network or services this network is serving the attacker could harm it. ...
Bartosz Rosa's user avatar
4 votes

Meterpreter HTTPS detected by IPS

By default, Metasploit generates self-signed certificates with a random 4-character CN. Some aspect of that cert is most likely what the IPS is triggering on. You can override this by providing a ...
egypt's user avatar
  • 311
4 votes

What is the difference between an anti-virus and an IPS?

A good simplistic way to think of this is that an IPS generally is associated with a firewall, whereas AV is associated with software. In the McAfee environment I administer, I use IPS to block/...
baldPrussian's user avatar
  • 2,778
4 votes
Accepted

How does IPS terminate/decrypt encrypted traffic?

There are four ways an IPS can deal with encrypted traffic: An IPS can act as a TLS interception proxy, where it becomes a man-in-the-middle for the TLS connection. This requires you add a root ...
forest's user avatar
  • 66.9k
4 votes
Accepted

Comparison between WAF and IPS/IDS

As @schroeder says, the largest difference is where they sit in the stack. Let's talk about that difference. The Web Application Firewall works at the Application layer. That implies that it is ...
gowenfawr's user avatar
  • 72.9k
4 votes

Penetration testing or Malware analysis?

IDS is not about either penetration testing or malware analysis. An IDS inspects traffic (typically) to look for Indicators of Compromise (IoC). An IDS, then, is a consumer of whatever the IoCs are, ...
schroeder's user avatar
  • 131k
4 votes

What is an Albert sensor?

Any chance it's this: https://www.cisecurity.org/services/albert/ ? It says it's a Suricata based IDS (not clear to me what they add to plain Suricata, maybe this is a subscription to threat ...
Z.T.'s user avatar
  • 8,524
3 votes
Accepted

Detecting DNS tunneling

DNS does not use ICMP. It uses UDP (and rarely TCP) port 53. The firewall/router the captive portal contols either does not block that port or it is the DNS server and is responding. All other ...
billc.cn's user avatar
  • 3,946
3 votes

Snort rules to detect Meterpreter sessions

I know this is an old question, but searching I found this interesting post. There are the hints you need. Extracted from there You can do as Snort rule to detect Meterpreter sessions for external ...
OscarAkaElvis's user avatar
3 votes

Snort Unable to detect portscans in LAN

I was assuming that snort monitors packets in HOME_NETWORK in promiscous mode,Kindly correct me if i am wrong. Snort can only monitor packets which can be seen at the network card, even in ...
Steffen Ullrich's user avatar
3 votes

Reduce Noise when Penetration Testing

Without going too much into specifics (as they're very dependent on the circumstances of the test), you could think about things like this. How do SOCs find attackers? Well there's a couple of ways, ...
Rory McCune's user avatar
  • 62.4k

Only top scored, non community-wiki answers of a minimum length are eligible