0

Recently I checked my Apache domlog and noticed the following attack:

POST /index.php?page=shop.item_details&cat_id=150&flp=flp_images.tpl&prod_id=9191&vmcchk=1&option=com_vm&Itemid=999999.9)+%2f**%2fuNiOn%2f**%2faLl+%2f**%2fsElEcT+0x393133359144353632312e39,0x393133358134383632322e39...

which is an obvious attempt at SQL injection. This proceeded to occur around 3000 times from the same IP. Now I could blacklist this IP but are there some better rules to apply to prevent things like this from occuring server side?

This server is running CentOS 6.4

1
  • Edited out the duplicate side question.
    – SLIM
    Aug 30, 2013 at 22:31

1 Answer 1

0

Community, base core rule set included with modsecurity will detect and block these requsts based on string (like if it contains select and union and from) or according to scores, or frequency etc. Depends on how you want to configure it.

Example file: https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/master/base_rules/modsecurity_crs_41_sql_injection_attacks.conf

0

Not the answer you're looking for? Browse other questions tagged .