Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Recently I checked my Apache domlog and noticed the following attack:

POST /index.php?page=shop.item_details&cat_id=150&flp=flp_images.tpl&prod_id=9191&vmcchk=1&option=com_vm&Itemid=999999.9)+%2f**%2fuNiOn%2f**%2faLl+%2f**%2fsElEcT+0x393133359144353632312e39,0x393133358134383632322e39...

which is an obvious attempt at SQL injection. This proceeded to occur around 3000 times from the same IP. Now I could blacklist this IP but are there some better rules to apply to prevent things like this from occuring server side?

This server is running CentOS 6.4

share|improve this question

marked as duplicate by Greg Askew, mdpc, Ward, dawud, gWaldo Aug 31 '13 at 15:12

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
Edited out the duplicate side question. –  SLIM Aug 30 '13 at 22:31
add comment

1 Answer

up vote 0 down vote accepted

Community, base core rule set included with modsecurity will detect and block these requsts based on string (like if it contains select and union and from) or according to scores, or frequency etc. Depends on how you want to configure it.

Example file: https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/master/base_rules/modsecurity_crs_41_sql_injection_attacks.conf

share|improve this answer
    
This is great, thanks. –  SLIM Aug 31 '13 at 1:13
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.