Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm seeing malicious traffic (SQL injections) directed towards some of my websites and I want to use modsec to block the requests. An attack will look something like the following:

[31/Oct/2013:19:11:38 +0000] "POST /wp-content/themes/twentytwelve/404.php?act=sql&sql_login=someuser_wp1&sql_passwd=somepassword&sql_server=localhost&sql_port=3306&sql_db=someuser_wp1&sql_tbl_act=insert&sql_tbl=wp_users&sql_tbl_ls=0&sql_tbl_le=30&sql_tbl_insert_q=+%60ID%60+%3D+%271%27+AND+%60user_login%60+%3D+%27admin%27+AND+%60user_pass%60+%3D+%27%24P%24B07huSShCiGeWfJK9QD1iui%2FysZ%2FBi0%27+AND+%60user_nicename%60+%3D+%27admin%27+AND+%60user_email%60+%3D+%27jess%40dreamflow.co.uk%27+AND+%60user_url%60+%3D+%27%27+AND+%60user_registered%60+%3D+%272013-06-12+14%3A05%3A12%27+AND+%60user_activation_key%60+%3D+%27%27+AND+%60user_status%60+%3D+%270%27+AND+%60display_name%60+%3D+%27admin%27+ HTTP/1.1" 200 31585
[31/Oct/2013:19:11:41 +0000] "GET /wp-content/themes/twentytwelve/404.php?act=sql&sql_login=someuser_wp1&sql_passwd=somepassword&sql_server=localhost&sql_port=3306&sql_db=someuser_wp1&sql_db=someuser_wp1&sql_tbl=wp_options HTTP/1.1" 200 199628

The location/theme always varies, though. I want to basically block any request that matches these attacks no matter the URL (these are the two that I keep seeing). I've tried this like so, but haven't had any luck with it:

  <Files "^header.php">
  #SecRule REQUEST_URI "/header\.php\?act=sql&sql_login" "phase:2,log,deny,id:10010"
  </Files>

  <Files "^404.php">
  SecRule REQUEST_URI "/404\.php\?act=sql&sql_login" "phase:2,log,deny,id:10011"
  </Files>

In all of these attacks I've seen either the header.php or 404.php targeted (all of the attacks are against Wordpress sites), so I figured I'd try targeting that for my modsec rule, but so far I haven't been able to get it to work - even with the rules in place if I try to load the header.php or 404.php with the ?act=sql&sql_login string after them they still load.

Any assistance as to what I may doing wrong and the correct way to do this would be appreciated. I have some modsec books I've been trying to use as references, but no matter how I modify or change the rules I can't seem to get anything to work.

share|improve this question

migrated from meta.serverfault.com Nov 2 '13 at 14:08

This question came from our discussion, support, and feature requests site for system administrators and IT professionals.

2 Answers 2

I don't know if your modsec rule is correct but I think there's an error in your configuration which does not allow the rule to be applied.

To use regular expressions in the Files directive you have to add a ~ in your syntax or use the FilesMatch directive instead:

<Files ~ "^404.php">
   SecRule REQUEST_URI "/404\.php\?act=sql&sql_login" "phase:2,log,deny,id:10011"
</Files>

<FilesMatch "^404.php">
   SecRule REQUEST_URI "/404\.php\?act=sql&sql_login" "phase:2,log,deny,id:10011"
</FilesMatch>
share|improve this answer
    
Thanks for taking the time to respond. I've tried it with and without thaf, as well as trying filesmatch and location with no success. I fear that either my rules are bad or my regex is. Or both. –  Striketh Nov 2 '13 at 18:05
up vote 0 down vote accepted

Here's what I ended up doing which actually worked.

SecRule REQUEST_URI|ARGS "\?act=(sql&d|sql|sql_login|sql&sql_login)" "phase:2,log,deny,id:10011"

SecRule REQUEST_URI|ARGS "\?act=(sql&d|sql|sql_login|sql&sql_login)" "phase:2,log,deny,id:10012"

Taking out the and and tags and just putting the above rules worked as I expected it to. Perhaps I was doing something wrong with the above, but I'm just glad that I'm at least able to block further attacks of this nature.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.