Tabs and CRLF check in regex

Support Mod Joined: Feb 15, 2004 Posts: 806

ZX, this post originally a reply in Sentinel forum.

Quote:

Fortress not only filters on SPACES, but it also filters on HORIZONTAL TABS and CRLFs

ZX, if I may suggest to your upcoming UTC/Fortress code, there more than tabs and crlf can be used to replace whitespaces.
Some prove of concepts:

union%09select...
union%0aselect...
union%0dselect...
union%0a%0dselect... (notice it isn't crlf but lfcr)
union%7fselect... (non-braking space)

There's another control characters can also be used. To prevent this, you may consider to use \W in regex pattern.

Quote:

Admin Secure I've heard nothing but great things about. Unfortunately it doesn't seem to carry a big enough marketing scheme. Which is why I'm hoping the forum and more news on it will help it grow. (Correct me if I'm wrong madman)

Admin Secure as far as I know isn't much as popular as Fortress, Protector System, Admin Tap, NukeHackerTraps, Chatserv's patches, and others. I'm not so sure how many nuke admins using this addon. From site's log, most Admin Secure downloads are coming from Germany and Brazil.

Nuke Cops Founder Joined: Nov 14, 2002 Posts: 5939

Thanks madman, Fortress already takes into consideration any combination of crlf, and horizontal tabs, and spaces but not yet non-braking space. My question about that is its usefulness in a sql query?

As for the products of this class, I believe they are only my fortress, bob's sentinel, your admin secure, and mister's protector.

Support Mod Joined: Feb 15, 2004 Posts: 806

Zhen-Xjell wrote:

Thanks madman, Fortress already takes into consideration any combination of crlf, and horizontal tabs, and spaces but not yet non-braking space. My question about that is its usefulness in a sql query?

I do tests with some "abnormal" characters either thru GET or POST methods, and surprisely mySQL seem treating non-breaking space (char 0x7F) as normal space. I also do some tests with common control characters (0x00 thru 0x31) and some of them can be passed successfully into SQL queries. I have testing this in mySQL only. We need some feedbacks from users with non-mySQL DBs.

Zhen-Xjell wrote:

As for the products of this class, I believe they are only my fortress, bob's sentinel, your admin secure, and mister's protector.

NSN Secure Admin might also in this category because it strengthening admin and user account's areas. Nuke HackerTraps especially to block SQL Injection attempts.

Nuke Cops Founder Joined: Nov 14, 2002 Posts: 5939

I'll run some tests then with that control character and see what turns up.