• Choose a category
• All
• Classic-Fiction

By Root 2085 0

extensions of one kind or another, which require keywords that are often easier to detect. These patterns differ from one database to another, so creating a good set of detection rules requires expertise in the deployed database. Table 12-5 shows some interesting patterns for MSSQL and MySQL.

Table 12-5. Database-specific detection patterns

Pattern

Attack

exec.+xp_

MSSQL. Attempt to execute an extended stored procedure: EXEC xp_cmdshell.

exec.+sp_

MSSQL. Attempt to execute a stored procedure: EXEC sp_who.

@@[[:alnum:]]+

MSSQL. Access to an internal variable: SELECT @@version.

into[[:space:]]+outfile

MySQL. Attempt to write contents of a table to disk: SELECT * FROM '/tmp/users'.

load[[:space:]]+data

MySQL. Attempt to load a file from disk: LOAD DATA INFILE '/tmp/users' INTO TABLE users.

Cross-site scripting attacks

Cross-site scripting (XSS) attacks can be difficult to detect when launched by those who know how to evade detection systems. If the entry point is in the HTML, the attacker must find a way to change from HTML and into something more dangerous. Danger comes from JavaScript, ActiveX components, Flash programs, or other embedded objects. The following list of problematic HTML tags is by no means exhaustive, but it will prove the point:

Executes component when page is loaded (IE only)

...

Executes component when page is loaded

...

Executes applet when page is loaded

Executes code when page is loaded

Executes code when page is loaded