SQL Injection Builder
Every evasion works by expressing identical logic in bytes the blocklist does not contain. That is why detection must operate on normalised fields, and why the actual fix is at the application layer, not the signature layer.
Open in Red Team Toolkit — sqliSQL Injection Builder
Every evasion works by expressing identical logic in bytes the blocklist does not contain. That is why detection must operate on normalised fields, and why the actual fix is at the application layer, not the signature layer.
Telemetry generated
| Log source | Field / identifier | What it shows |
|---|---|---|
| Web Access Log | response_size / sc-bytes | Response size delta distinguishes successful extraction from a rejected attempt. A UNION SELECT that returns extra columns produces a measurably larger response than a baseline request to the same endpoint. Track average and standard deviation of response size per URI stem. |
| WAF Log | rule_match / action | WAF rule match events show blocked attempts. Requests that reach the application without a WAF match but still contain injection syntax are the high-value signal — they indicate WAF bypass. |
| Database Audit Log | statement_text | The only definitive proof of what data was reached. A successful injection appears here as a malformed statement containing attacker-controlled SQL. Enable general query logging on dev/staging; use audit plugins (MySQL Enterprise Audit, pgaudit) in production. |
| EDR / Endpoint Log | process_creation | Web or database process spawning a shell (cmd.exe, /bin/sh, powershell.exe) is the web-shell indicator. A successful SQLi leading to xp_cmdshell or INTO OUTFILE produces this process chain. |
Detection rules
title: SQL Injection Patterns in Web Request
id: b2c3d4e5-f6a7-8901-bcde-f12345678901
status: experimental
description: >
Matches normalised (URL-decoded) web request fields against SQLi keyword
groups covering syntax, tautology, timing, and encoded variants.
logsource:
category: webserver
detection:
syntax:
- 'UNION SELECT'
- 'UNION ALL SELECT'
tautology:
- "' OR '1'='1"
- "' OR 1=1"
- '" OR "a"="a'
timing:
- 'SLEEP('
- 'WAITFOR DELAY'
- 'PG_SLEEP('
- 'BENCHMARK('
encoded:
- '%27 OR'
- '%2527'
- '0x27'
condition: syntax or tautology or timing or encoded
falsepositives:
- Authorised penetration testing
- Developer documentation search endpoints
level: high
tags:
- attack.initial_access
- attack.t1190Evasion & counters
Keyword substitution — using || for OR and # or /**/ for comment sequences to avoid blocklist tokens.
Detect semantic and tautology structure rather than specific keywords. Stop relying on blocklists — a rule that matches the logical pattern (value comparison that always evaluates true) catches substitutions that a keyword list misses.
Percent and double-percent encoding (%27, %2527) to hide quote characters from signature matching.
Match on normalised fields — this is the single most important rule-writing lesson. Suricata's http.uri and http.request_body sticky buffers URL-decode automatically. In SPL, apply urldecode() twice to catch double-encoding.
Case variation and inline comments (UN/**/ION SE/**/LECT) to break keyword matching.
Use case-insensitive matching (nocase in Suricata, (?i) in regex) plus comment-stripping normalisation before signature matching.
Fully blind extraction returning no data in the HTTP response — the attacker infers results from timing or boolean differences.
Detect the behavioural shape: a long run of near-identical requests differing by one character with near-constant response sizes (stdev < 50 bytes), or response times clustering around a sleep interval. The Splunk query above flags this pattern.
Rule tuning
Preventive control
Parameterised queries (prepared statements) eliminate the vulnerability class entirely — every major language and ORM supports them. A WAF is a compensating control, not a fix: every evasion technique above exists precisely because someone treated the WAF as the primary control.