mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
43 lines
1.7 KiB
Markdown
43 lines
1.7 KiB
Markdown
---
|
|
title: "SQL Injection"
|
|
last_modified_at: 2017-09-19
|
|
toc: true
|
|
toc_label: ""
|
|
tags:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
- Web
|
|
---
|
|
|
|
[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
|
|
|
|
#### Description
|
|
|
|
Use the searches in this Analytic Story to help you detect structured query language (SQL) injection attempts characterized by long URLs that contain malicious parameters.
|
|
|
|
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
|
|
- **Datamodel**: [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web)
|
|
- **Last Updated**: 2017-09-19
|
|
- **Author**: Bhavin Patel, Splunk
|
|
- **ID**: 4f6632f5-449c-4686-80df-57625f59bab3
|
|
|
|
#### Narrative
|
|
|
|
It is very common for attackers to inject SQL parameters into vulnerable web applications, which then interpret the malicious SQL statements.\
|
|
This Analytic Story contains a search designed to identify attempts by attackers to leverage this technique to compromise a host and gain a foothold in the target environment.
|
|
|
|
#### Detections
|
|
|
|
| Name | Technique | Type |
|
|
| ----------- | ----------- |--------------|
|
|
| [SQL Injection with Long URLs](/web/sql_injection_with_long_urls/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP |
|
|
|
|
#### Reference
|
|
|
|
* [https://capec.mitre.org/data/definitions/66.html](https://capec.mitre.org/data/definitions/66.html)
|
|
* [https://www.incapsula.com/web-application-security/sql-injection.html](https://www.incapsula.com/web-application-security/sql-injection.html)
|
|
|
|
|
|
|
|
[*source*](https://github.com/splunk/security_content/tree/develop/stories/sql_injection.yml) \| *version*: **1** |