{"id":"5513deaf-f49a-46c2-a6c8-3f111b5cb453","title":"SQL Injection Strings In URI","description":"Detects potential SQL injection attempts via GET requests in access logs.","author":"Saw Win Naung, Nasreddine Bencherchali (Nextron Systems), Thurein Oo (Yoma Bank)","status":"test","level":"high","date":"2020-02-22","modified":"2023-09-04","tags":["attack.initial-access","attack.t1190"],"technique_ids":["T1190"],"logsource":{"category":"webserver"},"falsepositives":["Java scripts and CSS Files","User searches in search boxes of the respective website","Internal vulnerability scanners can cause some serious FPs when used, if you experience a lot of FPs due to this think of adding more filters such as \"User Agent\" strings and more response codes"],"references":["https://www.acunetix.com/blog/articles/exploiting-sql-injection-example/","https://www.acunetix.com/blog/articles/using-logs-to-investigate-a-web-application-attack/","https://brightsec.com/blog/sql-injection-payloads/","https://github.com/payloadbox/sql-injection-payload-list","https://book.hacktricks.xyz/pentesting-web/sql-injection/mysql-injection"],"source_path":"rules/web/webserver_generic/web_sql_injection_in_access_logs.yml","source_sha256":"47fb81be3fa4b09addf9ee97cd1053c3d9007d9080e343ed0e83c4eb356a6e2e","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/webserver_generic/web_sql_injection_in_access_logs.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: SQL Injection Strings In URI\nid: 5513deaf-f49a-46c2-a6c8-3f111b5cb453\nstatus: test\ndescription: Detects potential SQL injection attempts via GET requests in access logs.\nreferences:\n    - https://www.acunetix.com/blog/articles/exploiting-sql-injection-example/\n    - https://www.acunetix.com/blog/articles/using-logs-to-investigate-a-web-application-attack/\n    - https://brightsec.com/blog/sql-injection-payloads/\n    - https://github.com/payloadbox/sql-injection-payload-list\n    - https://book.hacktricks.xyz/pentesting-web/sql-injection/mysql-injection\nauthor: Saw Win Naung, Nasreddine Bencherchali (Nextron Systems), Thurein Oo (Yoma Bank)\ndate: 2020-02-22\nmodified: 2023-09-04\ntags:\n    - attack.initial-access\n    - attack.t1190\nlogsource:\n    category: webserver\ndetection:\n    selection:\n        cs-method: 'GET'\n    keywords:\n        - '@@version'\n        - '%271%27%3D%271'\n        - '=select '\n        - '=select('\n        - '=select%20'\n        - 'concat_ws('\n        - 'CONCAT(0x'\n        - 'from mysql.innodb_table_stats'\n        - 'from%20mysql.innodb_table_stats'\n        - 'group_concat('\n        - 'information_schema.tables'\n        - 'json_arrayagg('\n        - 'or 1=1#'\n        - 'or%201=1#'\n        - 'order by '\n        - 'order%20by%20'\n        - 'select * '\n        - 'select database()'\n        - 'select version()'\n        - 'select%20*%20'\n        - 'select%20database()'\n        - 'select%20version()'\n        - 'select%28sleep%2810%29'\n        - 'SELECTCHAR('\n        - 'table_schema'\n        - 'UNION ALL SELECT'\n        - 'UNION SELECT'\n        - 'UNION%20ALL%20SELECT'\n        - 'UNION%20SELECT'\n        - \"'1'='1\"\n    filter_main_status:\n        sc-status: 404\n    condition: selection and keywords and not 1 of filter_main_*\nfalsepositives:\n    - Java scripts and CSS Files\n    - User searches in search boxes of the respective website\n    - Internal vulnerability scanners can cause some serious FPs when used, if you experience a lot of FPs due to this think of adding more filters such as \"User Agent\" strings and more response codes\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1190","id":"T1190","name":"Exploit Public-Facing Application","page":"techniques/enterprise/T1190/"}],"data_path":"data/detection-rules/5513deaf-f49a-46c2-a6c8-3f111b5cb453.json","kind":"sigma"}