Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My web server periodically comes under attack, and I get a bunch of requests that look like

/my.page?union+all+select+0x31303235343830303536%2C0x31303235343830303536%2C0x31303235343830303536--

Are there simple command line tools to decode this?

share|improve this question

closed as off-topic by Nathan C, TheCleaner, dawud, Tom O'Connor Aug 27 '13 at 20:26

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking product, service, or learning material recommendations are off-topic because they tend to become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – TheCleaner, dawud, Tom O'Connor
If this question can be reworded to fit the rules in the help center, please edit the question.

2  
Answered here: stackoverflow.com/questions/4600954/… –  Greg Askew Aug 27 '13 at 18:06
    
@GregAskew: That question is asking what happened as a result of an attack. I'm looking for a tool to help me decode the various results. –  chris Aug 27 '13 at 18:08
1  
It's too bad a site like: area51.stackexchange.com/proposals/59278/it-shopping-questions doesn't exist yet. :) –  TheCleaner Aug 27 '13 at 18:13
    
@chris: the top answer has the breakdown –  Greg Askew Aug 27 '13 at 18:40

1 Answer 1

it appears to be the Havij SQL injection tool. The requests are trying to locate how many columns are in a particular table.

Please learn about preventing SQL injections and attacks like this won't even work.

share|improve this answer
    
I'm aware of Havij, and am very familiar with sql injection. But I can't find a simple tool to decode what ends up in the log. –  chris Aug 27 '13 at 18:10
    
It's just hex. There's many tools online. The hex in question is just random characters (in hex) in order to get a column count. –  Nathan C Aug 27 '13 at 18:11
    
Sure, but there are hundreds of request that use different techniques for obfuscating the actual request - I was hoping to be able to extract them from my logs, pipe them to a tool, and view the results. –  chris Aug 27 '13 at 18:26
    
I'm not aware of any tool that does this...what you're asking is for a tool that can detect every possible request and decode them, which i don't believe is possible. You can use something like GreenSQL as a "proxy" to log and report malicious-like queries, but that's all I have. –  Nathan C Aug 27 '13 at 19:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.