Well, I think that deploying active response can be a good way out to prevent SQL Injection based attacks. However, there may be a few issues related to it viz..decoders in ossec are designed to indicate a SQL Injection attack even in case SELEC/UNION or any other SQL Based command is used in the Request. This may be a bit of hinderance, as it may be that the legitimate traffic is being blocked.
I have already deployed Active Response in testing Environment, and post deplpyment , launched a NESSUS Scan, and to my surprise, Active Response turned out to be fantastic to prevent SQL Injection based attacks. Regards Tanishk On Fri, Feb 4, 2011 at 12:12 AM, Steven Stern < [email protected]> wrote: > On 02/03/2011 12:00 PM, satish patel wrote: > > How efficient OSSEC is to stop SQL injection ? If not then i have to > > move on mod_security > > > > Is anybody out there who using ossec for sql injection ? > > > > > > Thanks, > > S > It's very good at detecting SQL injection, but your code shouldn't > (<smile>) be susceptible to it. mod_security has its own issues with > false positives. > > -- > -- Steve > -- warm regards Tanishk Lakhaani
