Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Recently I checked my Apache domlog and noticed the following attack:

POST /index.php?page=shop.item_details&cat_id=150&flp=flp_images.tpl&prod_id=9191&vmcchk=1&option=com_vm&Itemid=999999.9)+%2f**%2fuNiOn%2f**%2faLl+%2f**%2fsElEcT+0x393133359144353632312e39,0x393133358134383632322e39...

which is an obvious attempt at SQL injection. This proceeded to occur around 3000 times from the same IP. Now I could blacklist this IP but are there some better rules to apply to prevent things like this from occuring server side?

This server is running CentOS 6.4

share|improve this question

marked as duplicate by Greg Askew, mdpc, Ward, dawud, gWaldo Aug 31 '13 at 15:12

This question was marked as an exact duplicate of an existing question.

Edited out the duplicate side question. – SLIM Aug 30 '13 at 22:31
up vote 0 down vote accepted

Community, base core rule set included with modsecurity will detect and block these requsts based on string (like if it contains select and union and from) or according to scores, or frequency etc. Depends on how you want to configure it.

Example file:

share|improve this answer
This is great, thanks. – SLIM Aug 31 '13 at 1:13

Not the answer you're looking for? Browse other questions tagged or ask your own question.