FortiWeb Lesson 07: Attack Signatures, SQL Injection and XSS

FORTIWEB CLASSROOM • LESSON 07

Level: Intermediate · Study and lab: 60 minutes
Instructor: Harpreet Singh Virdi, CISSP, CCSP

FortiWeb course guide · FortiWeb training block

---

Recognize what the protection is looking for

SQL injection and cross-site scripting are different application weaknesses. SQL injection lets unsafe input alter a database query. XSS causes untrusted content to be interpreted as executable browser content in an unsafe context. WAF checks provide a protective layer, while developers address the underlying coding flaws.

Parameterized database queries are a primary SQL-injection defense. Safe rendering and context-appropriate output handling are central XSS defenses. Do not describe a WAF as a permanent replacement for these controls.

What a signature match means

A signature identifies a pattern associated with a threat. A signature policy selects and configures checks. An alert indicates a match under the applicable settings, not proof that the target application is vulnerable or that an attack succeeded.

Some FortiWeb releases also provide syntax-based detection and false-positive mitigation capabilities. Availability depends on firmware, signature updates, and feature support. These mechanisms are distinct from simply matching a keyword. Record the engine and signature identifier that produced the event.

Guided lab

1. Identify the signature policy referenced by the bookshop protection profile.
2. If needed, clone a predefined policy before making lab changes.
3. Record the signature database version and inspect a relevant signature's description and action.
4. Send ordinary valid input and a legitimate title containing punctuation, such as O'Reilly networking.
5. Use an approved, documented test request for a selected signature in the isolated lab. Random attack-looking text is not guaranteed to match every engine or version.
6. Inspect the log for signature ID, matched location, policy, and action.
7. Compare detection with the client response and origin evidence.

Expected result: you can state exactly what matched and whether the configured response occurred. If valid content triggers a check, preserve the example for the tuning lesson rather than disabling a whole category.

Context matters

A code tutorial may legitimately contain words and symbols that are suspicious in an account identifier. An apostrophe alone does not prove SQL injection. The application's expected input, parsing, and the specific engine determine how to investigate the event.

Likewise, absence of a signature match does not certify safe behavior. Keep complementary input constraints and application controls. Update security definitions through a reviewed process and test representative traffic after changes.

Mini-exercise

Write two event summaries: one for a documented lab detection, and one for legitimate punctuation. Include the exact check, location, response, and what remains unproven. Avoid asserting “compromised” from a single match.

Knowledge check

Should you globally disable XSS signatures because a rich-text field triggers one?

Instructor answer

No. Investigate the exact match and legitimate requirement. Consider only a justified, scoped exception with positive and negative regression tests.

---

Official reading

• Fortinet: configuring action overrides or exceptions to data leak attack detection signatures
• Fortinet: false positive mitigation for signature based protection

Independent training, not affiliated with Fortinet. Examples use an authorized isolated lab with synthetic data. The lab steps and expected outcomes have not been executed on a FortiWeb appliance for this publication. Firmware, platform, operating mode, licensing, and subscriptions affect behavior; follow the documentation for your exact build. References use 8.0.x examples and do not constitute an upgrade recommendation.

← Previous FortiWeb lesson · FortiWeb course guide · Next FortiWeb lesson →