INSPECTING
Checking against the OWASP Core Rule Set…
WHAT THIS MEANS FOR YOUInspecting the request…
PASSED
No attack pattern found.
WHAT THIS MEANS FOR YOUReal customers get through normally. Nothing gets in their way.
Checked against the OWASP Core Rule Set. Nothing matched, so the request passes straight through, in either mode.
FLAGGED
SQL injection pattern detected.
WHAT THIS MEANS FOR YOULeft unchecked on a vulnerable app, an attacker could log in as someone else, with no password.
A classic trick: get a login or search field to run a database command instead of searching for text. Here, it is only logged and scored, not blocked, so your team can review it before anything real gets stopped. Switch to Blocking mode to see what happens next.
BLOCKED
SQL injection pattern detected.
WHAT THIS MEANS FOR YOULeft unchecked on a vulnerable app, an attacker could log in as someone else, with no password.
A classic trick: get a login or search field to run a database command instead of searching for text. Here, it is stopped outright. Left uncaught, on a vulnerable login, this string can let an attacker in with no real password.
FLAGGED
Cross-site scripting pattern detected.
WHAT THIS MEANS FOR YOULeft unchecked on a vulnerable page, customers who read the comment could have their sessions stolen.
Hidden code rides along inside ordinary text, then runs in the browser of every visitor who views the page. Here, it is only logged and scored, not blocked, so your team can review it before anything real gets stopped. Switch to Blocking mode to see what happens next.
BLOCKED
Cross-site scripting pattern detected.
WHAT THIS MEANS FOR YOULeft unchecked on a vulnerable page, customers who read the comment could have their sessions stolen.
Hidden code rides along inside ordinary text, then runs in the browser of every visitor who views the page. Here, it is stopped outright. Left uncaught, the script would copy the session of every visitor who opens the page.
FLAGGED
Remote code execution pattern detected.
WHAT THIS MEANS FOR YOULeft unchecked on a vulnerable app, an attacker could read files on the server that runs it.
An extra command is tacked onto normal form input, hoping the server runs the command without checking. Here, it is only logged and scored, not blocked, so your team can review it before anything real gets stopped. Switch to Blocking mode to see what happens next.
BLOCKED
Remote code execution pattern detected.
WHAT THIS MEANS FOR YOULeft unchecked on a vulnerable app, an attacker could read files on the server that runs it.
An extra command is tacked onto normal form input, hoping the server runs the command without checking. Here, it is stopped outright. Left uncaught, a vulnerable server could hand over its own system files.
