Forum Discussion

imac_105647's avatar
imac_105647
Icon for Nimbostratus rankNimbostratus
Jul 08, 2010

Attack signature not triggered

Hello,     We had a visit from an attacker last night and ASM did not trigger on this URI:     /content/job-details.php?id=-49893%20UNION%20SELECT%20CHAR(97,102,56,56,48,48,55,53,97,97)--1...
app sec
BIG-IP Access Policy Manager (APM)
security
hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
Jul 08, 2010
Hi Ian,

 

 

I tried testing with a parameter value set to -49893%20UNION%20SELECT%20CHAR(97,102,56,56,48,48,55,53,97,97)--1040 and see two signatures triggered:

 

 

SQL-INJ "UNION SELECT" (Parameter) 200000073

 

SQL-INJ CHAR() 200002270

 

 

Can you confirm these two signatures are enabled in your policy under the Attack Signatures | Policy Attack Signatures? If so, are they still enabled on the id or global * parameter? Does the parameter that the request matched have checks enabled?

 

 

If you want to email me the full request info page, I can take a quick look today.

 

 

Aaron