topic Re: HTTP and sql injection by facebook-mail in General Topics

HTTP and sql injection by facebook-mail

migration — Wed, 27 Oct 2010 16:49:35 GMT

Hi all,

We recently found a threat "HTTP SQL Injection Attempt" (ID = 30514) with the application "facebook-mail".

We found that information quite strange. What does it mean exactly?

Was there some patterns (for example a SQL specific pattern) in the mail?

I had a packets capture, but I wasn't be able to find something interesting in there.

I'm sure that some experts here can help me to understand that point.

Many thanks

Re: HTTP and sql injection by facebook-mail

migration — Thu, 28 Oct 2010 03:53:32 GMT

Hi,

I checked the PCAP you sent but since it was incomplete, I couldn't see the HTTP contents.

The very likely cause of the signature triggering would be that there was a URL contained within the traffic which contained SQL injection traffic. If you have the entire PCAP available, I can help in analyzing that.

Thanks,

Sandeep

Re: HTTP and sql injection by facebook-mail

migration — Thu, 28 Oct 2010 08:39:00 GMT

Hello Sjain,

The PCAP is the only pcap i have (obtained from the Appliance with the option "packet capture" on my vulnerabilities profiles).

Is it possible to obtain more complete captures in the future?

I assume you are right about the URL containing the SQL injection, unfortunately, it seems no possible to check now...

Regards,

Re: HTTP and sql injection by facebook-mail

migration — Thu, 28 Oct 2010 09:46:12 GMT

Hi,
I am checking with engineering on partial pcap issue. For better tracking, I'd recommend filing a support case though.

Thanks,
Sandeep

Re: HTTP and sql injection by facebook-mail

migration — Tue, 02 Nov 2010 20:26:39 GMT

Hi,

If you are filing a support case, please let me know the case #. Also include "show system info" output in the case.

Thanks,
Sandeep