This SonicWALL IPS signature category consists of a group of signatures that can detect and prevent attacks targeted at servers through standard internet ports. This category contains three main groups of attacks.
The first are web application attacks that attempt to input commands directly into the application, hoping that the application fails to verify the source of the input. On very badly written applications, this type of attack can allow attackers to change file permissions on a server, steal passwords, or execute arbitrary scripts. While dangerous, the chance of such an attack succeeding is low. Signatures in this group range from low- to high-priority.
The second type of attack involves usage of the PUT and DELETE requests that are part of the HTTP standard. These commands allow users to add or delete files on a server, and can be a security threat if the server is configured to handle these requests and has no way to verify their source. Most servers, however, are configured by default to ignore these requests, so these signatures are set only to detect such traffic. If a server is not meant to allow users to upload or edit content but administrators notice a large number of PUT or DELETE HTTP requests, they can consider enabling the signatures for prevention becaue there is a good chance that attackers are attempting to vandalise their server.
The final type of attack allows attackers to bypass authentication routines for certain web applications. For example, the Axis Network Camera has an authentication routine for users who wish to remotely access the camera. Attackers can gain access to the camera by slightly modifying the URL request that they enter into their browser, bypassing the security system. These attacks are classified as medium priority threats.
