rules/application/sql/app_sqlinjection_errors.yml

title: Suspicious SQL Error Messages
id: 8a670c6d-7189-4b1c-8017-a417ca84a086
status: test
description: Detects SQL error messages that indicate probing for an injection attack
author: Bjoern Kimminich
references:
  - http://www.sqlinjection.net/errors
date: 2017/11/27
modified: 2021/11/27
logsource:
  category: application
  product: sql
detection:
  keywords:
        # Oracle
    - quoted string not properly terminated
        # MySQL
    - You have an error in your SQL syntax
        # SQL Server
    - Unclosed quotation mark
        # SQLite
    - 'near "*": syntax error'
    - SELECTs to the left and right of UNION do not have the same number of result columns
  condition: keywords
falsepositives:
  - Application bugs
level: high
tags:
  - attack.initial_access
  - attack.t1190
SQL Injection error message patterns 2017-11-27 22:52:17 +01:00			`title: Suspicious SQL Error Messages`
Added UUIDs to rules 2019-11-12 23:12:27 +01:00			`id: 8a670c6d-7189-4b1c-8017-a417ca84a086`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`status: test`
SQL Injection error message patterns 2017-11-27 22:52:17 +01:00			`description: Detects SQL error messages that indicate probing for an injection attack`
			`author: Bjoern Kimminich`
Change All "str" references to be "list"to mach schema update 2018-01-28 02:24:16 +03:00			`references:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`- http://www.sqlinjection.net/errors`
			`date: 2017/11/27`
			`modified: 2021/11/27`
SQL Injection error message patterns 2017-11-27 22:52:17 +01:00			`logsource:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`category: application`
			`product: sql`
SQL Injection error message patterns 2017-11-27 22:52:17 +01:00			`detection:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`keywords:`
SQL Injection error message patterns 2017-11-27 22:52:17 +01:00			`# Oracle`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`- quoted string not properly terminated`
SQL Injection error message patterns 2017-11-27 22:52:17 +01:00			`# MySQL`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`- You have an error in your SQL syntax`
SQL Injection error message patterns 2017-11-27 22:52:17 +01:00			`# SQL Server`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`- Unclosed quotation mark`
SQL Injection error message patterns 2017-11-27 22:52:17 +01:00			`# SQLite`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`- 'near "*": syntax error'`
			`- SELECTs to the left and right of UNION do not have the same number of result columns`
			`condition: keywords`
SQL Injection error message patterns 2017-11-27 22:52:17 +01:00			`falsepositives:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`- Application bugs`
SQL Injection error message patterns 2017-11-27 22:52:17 +01:00			`level: high`
Fixed my git issue 2020-09-13 22:03:04 -06:00			`tags:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`- attack.initial_access`
			`- attack.t1190`