Investigating_Web_Attacks Flashcards
(\%3C)|<)
It looks for opening angled bracket or its hex equivalent.
((\%2F)|\/)*
It looks for the forward slash for a closing tag or its hex equivalent.
[a-zA-Z0-9\%]+
It searches for upper and lower-case alphanumeric strings inside the tag, or their hex equivalent.
((\%3E)|(\%253E)|>)
It looks for closing angled bracket or its hex equivalent.
Operators: ‘’, $()
These operators ask the command line to execute the command provided
Logical operator: &&
The function of the AND operator (&&) is to execute a subsequent command if the execution of the previous command succeeds.
Logical operator: ||
Also known as the OR operator, || allows the execution of a subsequent command if the execution of the previous command fails.
Pipe Operator: |
The pipe operator (|) attaches the output of one command as the input for another.
/exec(\s|+)+(s|x)p\w+/ix
Regex for Detecting SQL Injection Attacks on an MSSQL Server
/((\%27)|('))union/ix
Regex for Detecting SQL Injection with the UNION Keyword
/(\%27)|(')|(--)|(\%23)|(#)/ix
Regex for Detecting SQL Meta-Characters
/((\%3C)|<)((\%2F)|\/)*[a-ZA-Z0-9\%]+((\%3E)|(\%253E)|>)/ix
Regex for Detecting Simple XSS Attack
script with toggle case
<script>
alert("XSS")
</script>Hex encoded script
%3cscript%3ealert(“XSS”)%3c/script%3e>
normal script
<script>
alert("XSS")
</script>
