Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

If I have a PHP site hosted on Apache and someone hacks it using SQL injection, is there a way I can find out exactly which script caused this by looking at my web server logs?
Or using some other way?

share|improve this question

1 Answer 1

up vote 0 down vote accepted

If your web server logs are logging the query parameters, then search for known SQL (e.g. SELECT) through the logs.

If they're not logging query parameters, then you're unlikely to find anything by searching the logs, rather you'll have to look for patterns - for example a repeated URL that wouldn't normally be repeated.

share|improve this answer
    
Ok this brings me to another question. How do you log query parameters? –  Frank Martin Apr 11 '13 at 3:10
    
One more thing. Shall I look into access logs or error logs? –  Frank Martin Apr 11 '13 at 3:17
    
The error logs should show failed hack attempts, not successful ones. So start with the access logs. To see how to change what's getting logged, maybe making a separate log for query parameters only, look at httpd.apache.org/docs/2.2/mod/mod_log_config.html . –  Jenny D Apr 11 '13 at 7:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.