News for hackers. Stuff that matters.

A comment on Preventing SQL Injections When WAF’s Not Enough.

Re:Preventing SQL Injections When WAF’s Not Enough by moutix on Thursday February 14, 2019 @04:22PM (#19166173)
That's why we now have RASP. It's better than SQL proxy and WAF, because you have both the SQL query and the HTTP parameters and you can correlate them to be super accurate
[ Parent | on HN ]
Re:Preventing SQL Injections When WAF’s Not Enough by ninegunpi on Friday February 15, 2019 @06:02AM (#19169928)
Isn't RASP just slapping the WAF-like signature detection into your application data streams directly? How would RASP prevent:

1. Insiders having access to database front?

2. Same SQL bypass techniques as employed to bypass WAFs?

3. Mitigate developer errors in query logic which enable custom injections?

[ Parent | on HN ]