Yes, the active response works on the basis of this only...When u launch a scan, a few attacks will acually pass thru, then only the agent will forward the corresponding logs to the OSSEC Server, who will then decide whether to use Active Response or not. Once the server decides to use active response, all the future attacks from the attacker IP will be prevented from being executed.....This is how active respone works.
Btw, Steve, can u pls tell me how is the link that u have just circulated (the XKCD reference) is helpful to us ? Regards Tanishk On Sat, Feb 5, 2011 at 2:18 AM, Steven Stern <[email protected] > wrote: > On 02/04/2011 12:39 PM, tanishk lakhaani wrote: > > Well, I think that deploying active response can be a good way out to > > prevent SQL Injection based attacks. However, there may be a few issues > > related to it viz..decoders in ossec are designed to indicate a SQL > > Injection attack even in case SELEC/UNION or any other SQL Based command > > is used in the Request. This may be a bit of hinderance, as it may be > > that the legitimate traffic is being blocked. > > > > I have already deployed Active Response in testing Environment, and post > > deplpyment , launched a NESSUS Scan, and to my surprise, Active Response > > turned out to be fantastic to prevent SQL Injection based attacks. > > > > Regards > > Tanishk > > > > On Fri, Feb 4, 2011 at 12:12 AM, Steven Stern > > <[email protected] <mailto:[email protected]>> > > wrote: > > > > On 02/03/2011 12:00 PM, satish patel wrote: > > > How efficient OSSEC is to stop SQL injection ? If not then i have > to > > > move on mod_security > > > > > > Is anybody out there who using ossec for sql injection ? > > > > > > > > > Thanks, > > > S > > It's very good at detecting SQL injection, but your code shouldn't > > (<smile>) be susceptible to it. mod_security has its own issues with > > false positives. > > > > -- > > -- Steve > > > > > Unfortunately, the first attack line probably gets through. By the way, > mandatory XKCD reference: http://xkcd.com/327/ > > -- > -- Steve > -- warm regards Tanishk Lakhaani
