- Use Case Reference : SUC022
- Use Case Title : Sqlmap SQL Injection Scan User-Agent Inbound
- Use Case Detection : IDS / HTTP / SQL logs
- Attacker Class : Opportunists / Targeting Opportunists / Professional
- Attack Sophistication : Unsophisticated / Low / Mid-High
- Identified tool(s) : sqlmap automatic SQL injection and database takeover tool
- Source IP(s) : Random
- Source Countries : Random
- Source Port(s) : Random
- Destination Port(s) : 80/TCP, 443/TCP
Possible(s) correlation(s) :
- sqlmap automatic SQL injection and database takeover tool.
Source(s) :
Emerging Threats SIG 2008538 triggers are :
- The HTTP header should contain “sqlmap” User-Agent string. Example : “User-Agent: sqlmap/1.0-dev (http://sqlmap.sourceforge.net)“
- The source port could be any FROM EXTERNAL_NET in destination of an HOME_NET HTTP_PORTS.
