False positive

[huangchen007]

Nick, any idea why strings (below) is flagged as SQLi?

"Select count(*) from Monitor" detected with fingerprint of 'Ef(o)'
"Select * from Monitor where ID = 182517" detected with fingerprint of 'Eoknk'

[client9]

if the query is like this, then those will be "SQLi".
select * from table where id=($INPUT)

Feel free to remove the 'Ef(o)', 'Eoknk' fingerprints .

JIRA for instance allows "sql-like" inputs. I would white list these fields.

good luck

[huangchen007]

I 'm sorry to bother you again.
What can I do with the source code if I want to remove the 'Ef(o)', 'Eoknk' fingerprints.

[huangchen007]

It's done with modifying fingerprints.txt.
Is that right？

[client9]

YES,

But better you can check the fingerprint that comes out of IsSQLI and
compare to your whitelist.

On Wed, Jul 22, 2015 at 1:07 AM, C.Wong notifications@github.com wrote:

It's done with modifying fingerprints.txt.
Is that right？

—
Reply to this email directly or view it on GitHub
#91 (comment)
.

Nick Galbreath | Founder / CTO | @ngalbreath |
Signal Sciences | www.signalsciences.com | @signalsciences |

[huangchen007]

One more question. I couldn't find any code that manipulate fingerprint.txt. How do I control whitelist or blacklist?

[huangchen007]

oh, I understand. I read Makefile carefully and then know your design completely