Havij SQL Injection Filter

[rodrigum]

There doesn't seem to be a filter for this vulnerability at this time so I am trying to write one.  By default the program uses its name in the agent string;

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Havij

I am trying to create a vulnerability filter that looks for "Havij" in the agent string, my belief based on what I have read is the filter should read something like pattern-match http-req-headers, where I am stuck though is the value, since it has to be at least 7 bytes, is there a way to pad "Havij" so it meets the requirement?  Or am I going about this wrong.

Thanks.

[migration]

In this case you don't have to create a Custom Vulnerability Signature but a Custom Application Signature, in the way you have told and creating a security policy with the deny action for that application.

You have to use "http-req-headers" and insert "Havij" as pattern match. This should works.

[rodrigum]

Same error, "must be at least 7 bytes".  I am running 3.1 if that helps.

Thanks.

[bpappas]

if you do not have a 7 byte anchor for your data pattern then you will get that error.

In your case your data pattern is not long enough. Can you pad the pattern with additional characters?

[rodrigum]

The string I posted above is what is passed, is there an easy way to use that to create the match string included in it the padding I need/

[bpappas · Accepted solution]

Have you tried this:

\)\ Havij