False Positive SQL Injection

Viewing 4 replies - 1 through 4 (of 4 total)
  • WFGerroald

    (@wfgerald)

    6 years, 3 months ago

    Hey @nicegamer7,

    Wordfence does not block all SQL queries.

    Can you please share screenshots of blocks in Wordfence > Live Traffic? Please share the expanded Details, this will give us a better idea of if they’re false positives or not.

    Please let me know.

    Thanks,

    Gerroald

    Thread Starter nicegamer7

    (@nicegamer7)

    6 years, 3 months ago

    For example: https://i.imgur.com/tc1ptNg.png

    • This reply was modified 6 years, 3 months ago by nicegamer7.
    wfdave

    (@wfdave)

    6 years, 3 months ago

    Hi @nicegamer7,

    It is true that the query you wrote does nothing – however, it has the potential to reveal to the attacker that your site is susceptible to SQL injection.

    For example, another type of attack, directory traversal is also blocked by Wordfence.

    /?file=../../../some_file – even if some_file does not exist, your site could spit out a message that indicates that it is reading out sensitive files.

    The point is to prevent the attacker from even being able to test if your site is vulnerable.

    Dave

    Thread Starter nicegamer7

    (@nicegamer7)

    6 years, 3 months ago

    Ok, thank you, that answers my question.

Viewing 4 replies - 1 through 4 (of 4 total)

The topic ‘False Positive SQL Injection’ is closed to new replies.