Björn Kimminich
8a8387c43e
Rule file that detects error messages from different DB providers that would occur during SQL Injection probing
23 lines
676 B
Plaintext
23 lines
676 B
Plaintext
title: Suspicious SQL Error Messages
|
|
description: Detects SQL error messages that indicate probing for an injection attack
|
|
author: Bjoern Kimminich
|
|
reference: http://www.sqlinjection.net/errors
|
|
logsource:
|
|
category: application
|
|
product: sql
|
|
detection:
|
|
keywords:
|
|
# Oracle
|
|
- quoted string not properly terminated
|
|
# MySQL
|
|
- You have an error in your SQL syntax
|
|
# SQL Server
|
|
- Unclosed quotation mark
|
|
# SQLite
|
|
- near "*": syntax error
|
|
- SELECTs to the left and right of UNION do not have the same number of result columns
|
|
condition: keywords
|
|
falsepositives:
|
|
- Application bugs
|
|
level: high
|