Hot answers tagged

173 votes
Accepted

Is it possible to detect 100% of SQLi with a simple regex?

Keyword filtering for SQLi is not a good technique. There are too many ways to bypass it. Crazy things like sel/**/ect might work, for instance. Or playing games with substr(). And then there's EXEC('...
user avatar
  • 123k
108 votes

Is it possible to detect 100% of SQLi with a simple regex?

NO Since every SQL injection is (by definition) valid SQL and since SQL is a context-free language (source), there is (again, by definition) no regex capable of matching an SQL injection, and trying ...
user avatar
  • 1,724
59 votes

Is it possible to detect 100% of SQLi with a simple regex?

Technically, this is completely possible (though doing so also renders the database useless): .+ Will indeed detect any possible SQLi. However, it will also detect any attempt to do normal queries(...
user avatar
  • 907
24 votes

Is it possible to detect 100% of SQLi with a simple regex?

I'm wondering if it is possible to detect 100% of the possible SQLi attacks using a simple regex. The very fact that you're asking the question this way shows you're thinking about the problem ...
user avatar
20 votes
Accepted

Detect non HTTP packets using port 80

IDSs and several deep inspection firewalls (sometimes called NGFW or UTM) can usually detect whether the traffic is HTTP or not. Also a HTTP proxy in front would simply block anything which is not ...
user avatar
19 votes
Accepted

DoS in local network computer

A little background first. As you know, when communicating over a network, programs split raw data into "packets", which as well as this raw data also contain some extra information: Where does this ...
user avatar
  • 788
19 votes
Accepted

Reduce Noise when Penetration Testing

You want to increase signal and reduce noise during a pen test? Great! Here are some things to ponder on: For answers to the questions you have -- are they already answered somewhere else? For ...
user avatar
  • 18.9k
14 votes
Accepted

Is it possible to detect DPI (Deep Packet Inspection)?

It depends on the kind of DPI you are talking about. If it is purely passive DPI (i.e. only looking at the packets) then you will not be able to detect it. If this is instead DPI which can modify the ...
user avatar
13 votes
Accepted

Can the IPS technology in a UTM prevent a DDoS attack?

No, generally not, although of course they say they can. DDoS is about volume UTM is almost always at the local end of Internet access Therefore, DDoS can usually fill the Internet pipe before even ...
user avatar
  • 71.3k
13 votes

Reduce Noise when Penetration Testing

You have to make a choice: are you going for stealth, or for broad coverage and efficiency? Essentially all scanning tools, including nmap -sS, are easily detected by a competent SOC if run at a ...
user avatar
  • 15.8k
12 votes
Accepted

What are the difference between IPS and WAF in terms of DDoS?

Neither of these technologies can prevent a DDoS attack, what they can do is help to prevent a DDoS attack from taking down services. They have completely different functions so you can't say one is ...
user avatar
  • 17.3k
11 votes

How much traffic can a firewall node handle? Any real examples?

Having done tests for multiple clients where they claim "scans won't knock this over, you'll be alright", then an hour later we're having a meeting discussing how they're going to handle a serious ...
user avatar
  • 131k
11 votes

Is it possible to detect 100% of SQLi with a simple regex?

No. First of all, there are several evil things you can do with SQL injections which don't require the use of the SELECT keyword, like the infamous universal password ' OR '1' = '1 or the common ...
user avatar
  • 48.8k
10 votes

Detect non HTTP packets using port 80

The attacker can easily mimic HTTP traffic, so I will doubt any IDS/IPS would prevent a well developed shell from mimicking HTTP requests to exfiltrate data. It's very easy to create a fake HTML page, ...
user avatar
  • 50.5k
9 votes
Accepted

Isn't a HIDS, NIDS and WAF complementary?

You are correct to think that these three technologies are complementary and will often detect the same issues. However, that in itself is no reason not to use them in layers. One may catch things ...
user avatar
  • 71.3k
9 votes
Accepted

Why do we need IDS/IPS if a firewall is present?

Functionally, they are two different applications, but they are often meshed together because the monitoring process tends to be at the edge off the network. Many times you see UTM (Unified Threat ...
user avatar
  • 3,760
9 votes

Evading IDS in exploit development

While the other answer focuses on modifying the exploit itself, you can also modify the transport of the exploit, so that the IDS will not detect it (Disclaimer: some of this points to my own research)...
user avatar
9 votes
Accepted

How can the nmap tool be used to evade a firewall/IDS?

There are various ways that comes handy with nmap to evade the basic Firewall rules or Intrusion Detection Systems (IDS). Packet Fragmentation: This option evade pattern matching detection technique....
user avatar
  • 106
8 votes

DoS in local network computer

Generally, if you are doing DoS from computer to another, you are hitting anything (like routers, ...) between them with the same load.
user avatar
  • 2,683
7 votes
Accepted

Is there any good reason to choose IDS over IPS?

Passively listening to network traffic to detecting suspicious behavior is still important. There are only a few obvious attacks which you might detect and block immediately but there is lots of ...
user avatar
7 votes
Accepted

What is the difference between a HIDS/HIPS and an anti virus?

First, you talk about HIDS and HIPS. The 'D' stands for "Detection". It means that the protection system will be able to detect and alert upon a possible security event, but it will not attempt to ...
user avatar
7 votes
Accepted

HIDS - Choosing between regular OSSEC or Wazuh fork

Regarding Wazuh differences with OSSEC, the Wazuh team is working on updating the documentation to explain those better (and on a new release and installers). Wazuh new version (2.0, currently found ...
user avatar
  • 86
6 votes
Accepted

What is a next generation IDS?

Next generation is just marketing lingo and "IDS" itself too, as do IPS, NGFW, UTM and whatever they come up with next week. The underlying technologies got several enhancements in the past, e.g. they ...
user avatar
6 votes

Is there any good reason to choose IDS over IPS?

I would say that the main reason that most organizations would opt for an IDS over an IPS (assuming they do) is the fact that a false positive on an IDS is much less detrimental than an IPS' false ...
user avatar
  • 9,207
6 votes

Intrusion Detection System and Network Intrusion Detection Systems

Whats the difference between IDS and NIDS? The concept of IDS can be divided to Two classes, this are Host IDS and Network IDS or HIDS and NIDS. IDS ...
user avatar
6 votes

Detect non HTTP packets using port 80

Advanced IPS/IDS can help you. but there are some kinds of firewalls that are completely customized for web (HTTP/HTTPS). They are called WAFs, Web Application Firewalls. A good WAF with a proper ...
user avatar
  • 61
6 votes

How does advanced firewall scan data (check for signature etc) if it is encrypted?

For actually applying signatures to the decrypted traffic the firewall needs to have access to this traffic. The typical way to do this is by essentially doing a man in the middle attack, only that ...
user avatar
6 votes
Accepted

Benefit of using two network interfaces for intrusion detection system

The main benefit is speed. IDS isnt about prevention but rather about detection, so the packets that are routed to the production machine can be sent directly while the second port can mirror the ...
user avatar
6 votes
Accepted

How to connect a Raspberry Pi IDS to the home router to detect intrusions network wide?

If you want to passively monitor the whole network a monitor port on the router or similar would be sufficient - although most common home routers (the ones with WLAN and cable/DSL modem in it) don't ...
user avatar
5 votes

Log Attacks in Different Files using Snort

The Bad News Not directly, not in the way you want. You can specify multiple alert outputs, as described in the Section 2.6 of the manual. However, this will simply send the same alerts to multiple ...
user avatar
  • 15.1k

Only top scored, non community-wiki answers of a minimum length are eligible