|
| 1 | +:tocdepth: 3 |
| 2 | + |
| 3 | +policy/protocols/http/detect-sql-injection.zeek |
| 4 | +=============================================== |
| 5 | +.. zeek:namespace:: HTTP |
| 6 | +
|
| 7 | +SQL injection attack detection in HTTP. |
| 8 | + |
| 9 | +:Namespace: HTTP |
| 10 | +:Imports: :doc:`base/frameworks/notice </scripts/base/frameworks/notice/index>`, :doc:`base/frameworks/sumstats </scripts/base/frameworks/sumstats/index>`, :doc:`base/protocols/http </scripts/base/protocols/http/index>` |
| 11 | + |
| 12 | +Summary |
| 13 | +~~~~~~~ |
| 14 | +Redefinable Options |
| 15 | +################### |
| 16 | +================================================================================== ================================================================ |
| 17 | +:zeek:id:`HTTP::match_sql_injection_uri`: :zeek:type:`pattern` :zeek:attr:`&redef` Regular expression is used to match URI based SQL injections. |
| 18 | +:zeek:id:`HTTP::sqli_requests_interval`: :zeek:type:`interval` :zeek:attr:`&redef` Interval at which to watch for the |
| 19 | + :zeek:id:`HTTP::sqli_requests_threshold` variable to be crossed. |
| 20 | +:zeek:id:`HTTP::sqli_requests_threshold`: :zeek:type:`double` :zeek:attr:`&redef` Defines the threshold that determines if an SQL injection attack |
| 21 | + is ongoing based on the number of requests that appear to be SQL |
| 22 | + injection attacks. |
| 23 | +================================================================================== ================================================================ |
| 24 | + |
| 25 | +Redefinitions |
| 26 | +############# |
| 27 | +======================================================= ====================================================================== |
| 28 | +:zeek:type:`HTTP::Tags`: :zeek:type:`enum` |
| 29 | + |
| 30 | + * :zeek:enum:`HTTP::URI_SQLI`: |
| 31 | + Indicator of a URI based SQL injection attack. |
| 32 | +:zeek:type:`Notice::Type`: :zeek:type:`enum` The script annotates the notices it generates with an associated $uid |
| 33 | + connection identifier; always provides an attacker IP address in the |
| 34 | + $src field; and always provides a victim IP address in the $dst field. |
| 35 | + |
| 36 | + * :zeek:enum:`HTTP::SQL_Injection_Attacker`: |
| 37 | + Indicates that a host performing SQL injection attacks was |
| 38 | + detected. |
| 39 | + |
| 40 | + * :zeek:enum:`HTTP::SQL_Injection_Victim`: |
| 41 | + Indicates that a host was seen to have SQL injection attacks |
| 42 | + against it. |
| 43 | +:zeek:type:`SumStats::Observation`: :zeek:type:`record` |
| 44 | + |
| 45 | + :New Fields: :zeek:type:`SumStats::Observation` |
| 46 | + |
| 47 | + uid: :zeek:type:`string` :zeek:attr:`&optional` |
| 48 | +======================================================= ====================================================================== |
| 49 | + |
| 50 | +Hooks |
| 51 | +##### |
| 52 | +=============================================== ======================================================================= |
| 53 | +:zeek:id:`HTTP::sqli_policy`: :zeek:type:`hook` A hook that can be used to prevent specific requests from being counted |
| 54 | + as an injection attempt. |
| 55 | +=============================================== ======================================================================= |
| 56 | + |
| 57 | + |
| 58 | +Detailed Interface |
| 59 | +~~~~~~~~~~~~~~~~~~ |
| 60 | +Redefinable Options |
| 61 | +################### |
| 62 | +.. zeek:id:: HTTP::match_sql_injection_uri |
| 63 | + :source-code: policy/protocols/http/detect-sql-injection.zeek 41 41 |
| 64 | + |
| 65 | + :Type: :zeek:type:`pattern` |
| 66 | + :Attributes: :zeek:attr:`&redef` |
| 67 | + :Default: |
| 68 | + |
| 69 | + :: |
| 70 | + |
| 71 | + /^?((^?((^?((^?((^?(((?i:^?([\?&][^[:blank:]\x00-\x1f\|\+]+?=[\-[:alnum:]%]+([[:blank:]\x00-\x1f\+]|\/\*.*?\*\/)*'?([[:blank:]\x00-\x1f\+]|\/\*.*?\*\/|\)?;)+.*?(having|union|exec|select|delete|drop|declare|create|insert)([[:blank:]\x00-\x1f\+]|\/\*.*?\*\/)+)$?))|((?i:^?([\?&][^[:blank:]\x00-\x1f\|\+]+?=[\-0-9%]+([[:blank:]\x00-\x1f\+]|\/\*.*?\*\/)*'?([[:blank:]\x00-\x1f\+]|\/\*.*?\*\/|\)?;)+(x?or|n?and)([[:blank:]\x00-\x1f\+]|\/\*.*?\*\/)+'?(([^a-zA-Z&]+)?=|exists))$?)))$?)|((?i:^?([\?&][^[:blank:]\x00-\x1f\+]+?=[\-0-9%]*([[:blank:]\x00-\x1f\+]|\/\*.*?\*\/)*'([[:blank:]\x00-\x1f]|\/\*.*?\*\/)*(-|=|\+|\|\|)([[:blank:]\x00-\x1f\+]|\/\*.*?\*\/)*([0-9]|\(?convert|cast))$?)))$?)|((?i:^?([\?&][^[:blank:]\x00-\x1f\|\+]+?=([[:blank:]\x00-\x1f\+]|\/\*.*?\*\/)*'([[:blank:]\x00-\x1f\+]|\/\*.*?\*\/|;)*(x?or|n?and|having|union|exec|select|delete|drop|declare|create|regexp|insert)([[:blank:]\x00-\x1f\+]|\/\*.*?\*\/|[\[(])+[a-zA-Z&]{2,})$?)))$?)|((?i:^?([\?&][^[:blank:]\x00-\x1f\+]+?=[^\.]*?(char|ascii|substring|truncate|version|length)\()$?)))$?)|(^?(\/\*![[:digit:]]{5}.*?\*\/)$?))$?/ |
| 72 | + |
| 73 | + |
| 74 | + Regular expression is used to match URI based SQL injections. |
| 75 | + |
| 76 | +.. zeek:id:: HTTP::sqli_requests_interval |
| 77 | + :source-code: policy/protocols/http/detect-sql-injection.zeek 38 38 |
| 78 | + |
| 79 | + :Type: :zeek:type:`interval` |
| 80 | + :Attributes: :zeek:attr:`&redef` |
| 81 | + :Default: ``5.0 mins`` |
| 82 | + |
| 83 | + Interval at which to watch for the |
| 84 | + :zeek:id:`HTTP::sqli_requests_threshold` variable to be crossed. |
| 85 | + At the end of each interval the counter is reset. |
| 86 | + |
| 87 | +.. zeek:id:: HTTP::sqli_requests_threshold |
| 88 | + :source-code: policy/protocols/http/detect-sql-injection.zeek 33 33 |
| 89 | + |
| 90 | + :Type: :zeek:type:`double` |
| 91 | + :Attributes: :zeek:attr:`&redef` |
| 92 | + :Default: ``50.0`` |
| 93 | + |
| 94 | + Defines the threshold that determines if an SQL injection attack |
| 95 | + is ongoing based on the number of requests that appear to be SQL |
| 96 | + injection attacks. |
| 97 | + |
| 98 | +Hooks |
| 99 | +##### |
| 100 | +.. zeek:id:: HTTP::sqli_policy |
| 101 | + :source-code: policy/protocols/http/detect-sql-injection.zeek 52 52 |
| 102 | + |
| 103 | + :Type: :zeek:type:`hook` (c: :zeek:type:`connection`, method: :zeek:type:`string`, unescaped_URI: :zeek:type:`string`) : :zeek:type:`bool` |
| 104 | + |
| 105 | + A hook that can be used to prevent specific requests from being counted |
| 106 | + as an injection attempt. Use a 'break' statement to exit the hook |
| 107 | + early and ignore the request. |
| 108 | + |
| 109 | + |
0 commit comments