topic Re: SQLinjection not being detected by PA in General Topics

SQLinjection not being detected by PA

SOC_CSG — Tue, 25 Aug 2015 13:21:36 GMT

Hi, we are receiving these tries about SQL injection but our Palo alto is not detecting it. How can we do that PA detect this SQLi????? we have updated the threats signatures.

Sql injection

GET /ficha-modelo?id=2&entidad=99999999%27%20oR%20%277%27=%277 HTTP/1.1" 500 59878 "-" "Mozilla/4.0

GET /ficha-modelo?entidad=!S!WCRTESTINPUT000000%3C%3E%3c%3e%253c%253e!E!&id=2 HTTP/1.1" 500 59878 "-" "Mozilla/4.0"

Re: SQLinjection not being detected by PA

pankaku — Tue, 25 Aug 2015 13:27:44 GMT

Have you applied proper security profiles to the concern security policies?

Re: SQLinjection not being detected by PA

SOC_CSG — Tue, 25 Aug 2015 13:35:26 GMT

Yes its matching the correct policy.

Re: SQLinjection not being detected by PA

pankaku — Tue, 25 Aug 2015 14:31:10 GMT

No I am talking about the antivirus, antispyware, vulnerabiltiy profile are applied to the security rules?

Re: SQLinjection not being detected by PA

SOC_CSG — Tue, 25 Aug 2015 14:44:38 GMT

we have the 3 security profiles assigned in the default config for this connection. What can we do in order to detect this SQLi???

Re: SQLinjection not being detected by PA

cpainchaud — Tue, 25 Aug 2015 15:11:47 GMT

typicall something that should be caught by a WAF/ReverseProxy that is fine tuned for specific customer needs, not a firewall or a IPS in my opinion.

Re: SQLinjection not being detected by PA

pankaku — Tue, 25 Aug 2015 15:39:09 GMT

You have to create security profile and apply them into the security rules

Objectes> Security profiles> Antivirus> clone default one and modify it accordingly.

Objectes> Security profiles> Anti-Spyware> clone default one and modify it accordingly.

Objectes> Security profiles> Vulnerability Profile> clone default one and modify it accordingly.

The default profiles are okay but you cannot modify them that'w why we need to clone them.

Now go to the Policies> Security> Open the security policy which is allowing the traffic and into that go to action call the above new profiles

Re: SQLinjection not being detected by PA

SOC_CSG — Tue, 25 Aug 2015 15:56:44 GMT

Yes i know but PA doesnt have the specific siganture for this SQLi. We have everything enabled and its not being detected.

Re: SQLinjection not being detected by PA

Lucky — Thu, 27 Aug 2015 20:42:47 GMT

Hi, COS,

SQLi will be the best effort, it will catch the most common attempts and will not evaluate any string for SQLi. If you really need that, create your own custom threat signature to improve posture, or consider offloading such job to a dedicated web / app firewall.

Great read on creating custom threat signatures can be found in this tech note: https://live.paloaltonetworks.com/t5/Articles/Creating-Custom-Threat-Signatures/ta-p/58569

Regards

Luciano