Security

Re: urlscan and querystring

steve schofield — Fri, 05 Sep 2008 21:40:37 GMT

I agree with the previous post. As they mention trimming rules, start with the common ones like CAST(, DECLARE, EXEC to see if you stop injections. If you just monitor the querystring item, that can help cutdown on false positives. I tried monitoring the RAW parameter and had a lot of legitimate traffic blocked. The only way as the other poster said is to validate your input parameters before submitting to your data store.

Re: urlscan and querystring

naziml — Fri, 05 Sep 2008 19:16:48 GMT

Keep trimming the rules list till you remove the false positives. Remember that UrlScan is only a stopgap for you to protect your resources while you fix your application to be hardened against SQL injection. The real fix for the issue is to fix your web application logic.

HTH.

Re: urlscan and querystring

sauminpatel — Wed, 03 Sep 2008 20:35:55 GMT

Hi Steve, Thanks for your response. I have the rules from your blog...but the problem is that even a keyword like "drop table" is a valid keyword on our site. How can i get around this problem? also, like i mentioned earlier "kill" is also a valid keyword. Please advise. Thanks!

Re: urlscan and querystring

steve schofield — Mon, 01 Sep 2008 03:40:52 GMT

Make sure your key words list in your sql injection attack does not have the key words you mentioned. I would verify what is listed in your rule.

urlscan and querystring

sauminpatel — Fri, 29 Aug 2008 15:55:17 GMT

hi,

our site is getting sql injection attacks right now and we have put up urlscan 3.0 on IIS 6. it is working fine. however, we have a search textbox where people can search for terms on our site...here if i enter words like "insertis" or "kill", etc (which are valid keywords on our site), urlscan catches it and rejects the request. I wanted to find out how can i avoid this? there are many keywords (and they are changing too!) on our site, so i cant put it under allowedquerystrings. Please let me know ASAP.

Thanks!