Menu
AWS WAF and AWS Shield Advanced
Developer Guide (API Version 2015-08-24)

Working with SQL Injection Match Conditions

Attackers sometimes insert malicious SQL code into web requests in an effort to extract data from your database. To allow or block web requests that appear to contain malicious SQL code, create one or more SQL injection match conditions. A SQL injection match condition identifies the part of web requests, such as the URI or the query string, that you want AWS WAF to inspect. Later in the process, when you create a web ACL, you specify whether to allow or block requests that appear to contain malicious SQL code.

Creating SQL Injection Match Conditions

When you create SQL injection match conditions, you specify filters, which indicate the part of web requests that you want AWS WAF to inspect for malicious SQL code, such as the URI or the query string. You can add more than one filter to a SQL injection match condition, or you can create a separate condition for each filter. Here's how each configuration affects AWS WAF behavior:

  • More than one filter per SQL injection match condition (recommended) – When you add a SQL injection match condition containing multiple filters to a rule and add the rule to a web ACL, a web request needs only to match one of the filters in the SQL injection match condition for AWS WAF to allow or block the request based on that condition.

    For example, suppose you create one SQL injection match condition, and the condition contains two filters. One filter instructs AWS WAF to inspect the URI for malicious SQL code, and the other instructs AWS WAF to inspect the query string. AWS WAF allows or blocks requests if they appear to contain malicious SQL code either in the URI or in the query string.

  • One filter per SQL injection match condition – When you add the separate SQL injection match conditions to a rule and add the rule to a web ACL, web requests must match all the conditions for AWS WAF to allow or block requests based on the conditions.

    Suppose you create two conditions, and each condition contains one of the two filters in the preceding example. When you add both conditions to the same rule and add the rule to a web ACL, AWS WAF allows or blocks requests only when both the URI and the query string appear to contain malicious SQL code.

Note

When you add a SQL injection match condition to a rule, you also can configure AWS WAF to allow or block web requests that do not appear to contain malicious SQL code.

To create a SQL injection match condition

  1. Sign in to the AWS Management Console and open the AWS WAF console at https://console.aws.amazon.com/waf/.

  2. In the navigation pane, choose SQL injection.

  3. Choose Create condition.

  4. Specify the applicable filter settings. For more information, see Values That You Specify When You Create or Edit SQL Injection Match Conditions.

  5. Choose Add another filter.

  6. If you want to add another filter, repeat steps 4 and 5.

  7. When you're finished adding filters, choose Create.

Values That You Specify When You Create or Edit SQL Injection Match Conditions

When you create or update a SQL injection match condition, you specify the following values:

Name

The name of the SQL injection match condition.

The name can contain only the characters A-Z, a-z, and 0-9. You can't change the name of a condition after you create it.

Part of the request to filter on

Choose the part of each web request that you want AWS WAF to inspect for malicious SQL code:

Header

A specified request header, for example, the User-Agent or Referer header. If you choose Header, specify the name of the header in the Header field.

HTTP method

The HTTP method, which indicates the type of operation that the request is asking the origin to perform. CloudFront supports the following methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, and PUT.

Query string

The part of a URL that appears after a ? character, if any.

URI

The part of a URL that identifies a resource, for example, /images/daily-ad.jpg.

Body

The part of a request that contains any additional data that you want to send to your web server as the HTTP request body, such as data from a form.

Note

If you choose Body for the value of Part of the request to filter on, AWS WAF inspects only the first 8192 bytes (8 KB). To allow or block requests for which the body is longer than 8192 bytes, you can create a size constraint condition. (AWS WAF gets the length of the body from the request headers.) For more information, see Working with Size Constraint Conditions.

Header

If you chose Header for Part of the request to filter on, choose a header from the list of common headers, or type the name of a header that you want AWS WAF to inspect for malicious SQL code.

Transformation

A transformation reformats a web request before AWS WAF inspects the request. This eliminates some of the unusual formatting that attackers use in web requests in an effort to bypass AWS WAF. Transformations can perform the following operations:

None

AWS WAF doesn't perform any text transformations on the web request before inspecting it for the string in Value to match.

Convert to lowercase

AWS WAF converts uppercase letters (A-Z) to lowercase (a-z).

HTML decode

AWS WAF replaces HTML-encoded characters with unencoded characters:

  • Replaces " with &

  • Replaces   with a non-breaking space

  • Replaces &lt; with <

  • Replaces &gt; with >

  • Replaces characters that are represented in hexadecimal format, &#xhhhh;, with the corresponding characters

  • Replaces characters that are represented in decimal format, &#nnnn;, with the corresponding characters

Normalize whitespace

AWS WAF replaces the following characters with a space character (decimal 32):

  • \f, formfeed, decimal 12

  • \t, tab, decimal 9

  • \n, newline, decimal 10

  • \r, carriage return, decimal 13

  • \v, vertical tab, decimal 11

  • non-breaking space, decimal 160

In addition, this option replaces multiple spaces with one space.

Simplify command line

For requests that contain operating system command line commands, use this option to perform the following transformations:

  • Delete the following characters: \ " ' ^

  • Delete spaces before the following characters: / (

  • Replace the following characters with a space: , ;

  • Replace multiple spaces with one space

  • Convert uppercase letters (A-Z) to lowercase (a-z)

URL decode

Decode a URL-encoded request.

Adding and Deleting Filters in a SQL Injection Match Condition

You can add or delete filters in a SQL injection match condition. To change a filter, add a new one and delete the old one.

To add or delete filters in a SQL injection match condition

  1. Sign in to the AWS Management Console and open the AWS WAF console at https://console.aws.amazon.com/waf/.

  2. In the navigation pane, choose SQL injection.

  3. Choose the condition that you want to add or delete filters in.

  4. To add filters, perform the following steps:

    1. Choose Add filter.

    2. Specify the applicable filter settings. For more information, see Values That You Specify When You Create or Edit SQL Injection Match Conditions.

    3. Choose Add.

  5. To delete filters, perform the following steps:

    1. Select the filter that you want to delete.

    2. Choose Delete filter.

Deleting SQL Injection Match Conditions

If you want to delete a SQL injection match condition, you need to first delete all filters in the condition and remove the condition from all the rules that are using it, as described in the following procedure.

To delete a SQL injection match condition

  1. Sign in to the AWS Management Console and open the AWS WAF console at https://console.aws.amazon.com/waf/.

  2. In the navigation pane, choose SQL injection.

  3. In the SQL injection match conditions pane, choose the SQL injection match condition that you want to delete.

  4. In the right pane, choose the Associated rules tab.

    If the list of rules using this SQL injection match condition is empty, go to step 6. If the list contains any rules, make note of the rules, and continue with step 5.

  5. To remove the SQL injection match condition from the rules that are using it, perform the following steps:

    1. In the navigation pane, choose Rules.

    2. Choose the name of a rule that is using the SQL injection match condition that you want to delete.

    3. In the right pane, select the SQL injection match condition that you want to remove from the rule, and choose Remove selected condition.

    4. Repeat steps b and c for all of the remaining rules that are using the SQL injection match condition that you want to delete.

    5. In the navigation pane, choose SQL injection.

    6. In the SQL injection match conditions pane, choose the SQL injection match condition that you want to delete.

  6. Choose Delete to delete the selected condition.