See here: http://www.ossec.net/wiki/Samples_of_attacks_detected_by_ossec
I would think the only issue here is that OSSEC is *responsive* and will look for patterns from the logs post-occurrence. So if your app is vulnerable to SQL injection, theoretically, the attacker would get in on the first try but could be blocked (depending on how you setup the Active Response) from then on out. Someone correct me if I'm wrong, but OSSEC may not be the best single tool to use to mitigate SQL Injection attacks. However, you can use OSSEC and ModSecurity together - ModSec would be setup to block the attack and OSSEC would be used to alert on any occurrences in the Apache/Modsec Logs. On Thu, Feb 3, 2011 at 10:00 AM, satish patel <[email protected]> wrote: > How efficient OSSEC is to stop SQL injection ? If not then i have to > move on mod_security > > Is anybody out there who using ossec for sql injection ? > > > Thanks, > S >
