Re: SQL injection

[Tim <tim-pentest () sentinelchicken org>]

> Detecting SQL injection with signatures alone, especially the
> relatively straight forward signatures used in most IDS and IPS systems
> is difficult. While some SQL injection attacks would be detected many
> others would not.   

Yes, thank you for stating this.

I am sure many IPS/IDSes are great for stopping a lot of attacks.  I
find it incredibly hard to believe that they stop all.  It is far better
to write good code in the first place.

To those people out there who recommended this or that IPS/IDS:  
Have you tested these against real attacks?  Have you tried diligently
to bypass them with obfuscation/fragmentation/etc?

tim