rules/application/sql/app_sqlinjection_errors.yml

title: Suspicious SQL Error Messages
id: 8a670c6d-7189-4b1c-8017-a417ca84a086
status: test
description: Detects SQL error messages that indicate probing for an injection attack
references:
    - http://www.sqlinjection.net/errors
author: Bjoern Kimminich
date: 2017/11/27
modified: 2023/02/12
tags:
    - attack.initial_access
    - attack.t1190
logsource:
    category: application
    product: sql
    definition: 'Requirements: application error logs must be collected (with LOG_LEVEL ERROR and above)'
detection:
    keywords:
        # Oracle
        - quoted string not properly terminated
        # MySQL
        - You have an error in your SQL syntax
        # SQL Server
        - Unclosed quotation mark
        # SQLite
        - 'near "*": syntax error'
        - SELECTs to the left and right of UNION do not have the same number of result columns
    condition: keywords
falsepositives:
    - A syntax error in MySQL also occurs in non-dynamic (safe) queries if there is an empty in() clause, that may often be the case.
level: high
SQL Injection error message patterns 2017-11-27 22:52:17 +01:00			`title: Suspicious SQL Error Messages`
Added UUIDs to rules 2019-11-12 23:12:27 +01:00			`id: 8a670c6d-7189-4b1c-8017-a417ca84a086`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`status: test`
SQL Injection error message patterns 2017-11-27 22:52:17 +01:00			`description: Detects SQL error messages that indicate probing for an injection attack`
Change All "str" references to be "list"to mach schema update 2018-01-28 02:24:16 +03:00			`references:`
$frack113$ Order yaml field 2022-10-25 06:48:55 +02:00			`- http://www.sqlinjection.net/errors`
			`author: Bjoern Kimminich`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`date: 2017/11/27`
feat: add new application vulnerability rules (#4034 ) 2023-02-15 13:29:53 +02:00			`modified: 2023/02/12`
$frack113$ Order yaml field 2022-10-25 06:48:55 +02:00			`tags:`
			`- attack.initial_access`
			`- attack.t1190`
SQL Injection error message patterns 2017-11-27 22:52:17 +01:00			`logsource:`
$frack113$ Order yaml field 2022-10-25 06:48:55 +02:00			`category: application`
			`product: sql`
feat: add new application vulnerability rules (#4034 ) 2023-02-15 13:29:53 +02:00			`definition: 'Requirements: application error logs must be collected (with LOG_LEVEL ERROR and above)'`
SQL Injection error message patterns 2017-11-27 22:52:17 +01:00			`detection:`
$frack113$ Order yaml field 2022-10-25 06:48:55 +02:00			`keywords:`
SQL Injection error message patterns 2017-11-27 22:52:17 +01:00			`# Oracle`
$frack113$ Order yaml field 2022-10-25 06:48:55 +02:00			`- quoted string not properly terminated`
SQL Injection error message patterns 2017-11-27 22:52:17 +01:00			`# MySQL`
$frack113$ Order yaml field 2022-10-25 06:48:55 +02:00			`- You have an error in your SQL syntax`
SQL Injection error message patterns 2017-11-27 22:52:17 +01:00			`# SQL Server`
$frack113$ Order yaml field 2022-10-25 06:48:55 +02:00			`- Unclosed quotation mark`
SQL Injection error message patterns 2017-11-27 22:52:17 +01:00			`# SQLite`
$frack113$ Order yaml field 2022-10-25 06:48:55 +02:00			`- 'near "*": syntax error'`
			`- SELECTs to the left and right of UNION do not have the same number of result columns`
			`condition: keywords`
SQL Injection error message patterns 2017-11-27 22:52:17 +01:00			`falsepositives:`
feat: add new application vulnerability rules (#4034 ) 2023-02-15 13:29:53 +02:00			`- A syntax error in MySQL also occurs in non-dynamic (safe) queries if there is an empty in() clause, that may often be the case.`
SQL Injection error message patterns 2017-11-27 22:52:17 +01:00			`level: high`