I'm seeing malicious traffic (sql injections) directed towards some of my websites and I want to use modsec to block the requests. An attack will look something like the following:
[31/Oct/2013:19:11:38 +0000] "POST /wp-content/themes/twentytwelve/404.php?act=sql&sql_login=someuser_wp1&sql_passwd=somepassword&sql_server=localhost&sql_port=3306&sql_db=someuser_wp1&sql_tbl_act=insert&sql_tbl=wp_users&sql_tbl_ls=0&sql_tbl_le=30&sql_tbl_insert_q=+%60ID%60+%3D+%271%27+AND+%60user_login%60+%3D+%27admin%27+AND+%60user_pass%60+%3D+%27%24P%24B07huSShCiGeWfJK9QD1iui%2FysZ%2FBi0%27+AND+%60user_nicename%60+%3D+%27admin%27+AND+%60user_email%60+%3D+%27jess%40dreamflow.co.uk%27+AND+%60user_url%60+%3D+%27%27+AND+%60user_registered%60+%3D+%272013-06-12+14%3A05%3A12%27+AND+%60user_activation_key%60+%3D+%27%27+AND+%60user_status%60+%3D+%270%27+AND+%60display_name%60+%3D+%27admin%27+ HTTP/1.1" 200 31585 [31/Oct/2013:19:11:41 +0000] "GET /wp-content/themes/twentytwelve/404.php?act=sql&sql_login=someuser_wp1&sql_passwd=somepassword&sql_server=localhost&sql_port=3306&sql_db=someuser_wp1&sql_db=someuser_wp1&sql_tbl=wp_options HTTP/1.1" 200 199628
The location/theme always varies, though. I want to basically block any request that matches these attacks no matter the URL (these are the two that I keep seeing). I've tried this like so, but haven't had any luck with it:
<Files "^header.php"> #SecRule REQUEST_URI "/header\.php\?act=sql&sql_login" "phase:2,log,deny,id:10010" </Files> <Files "^404.php"> SecRule REQUEST_URI "/404\.php\?act=sql&sql_login" "phase:2,log,deny,id:10011" </Files>
In all of these attacks I've seen either the header.php or 404.php targeted (all of the attacks are against Wordpress sites), so I figured I'd try targeting that for my modsec rule, but so far I haven't been able to get it to work - even with the rules in place if I try to load the header.php or 404.php with the ?act=sql&sql_login string after them they still load.
Any assistance as to what I may doing wrong and the correct way to do this would be appreciated. I have some modsec books I've been trying to use as references, but no matter how I modify or change the rules I can't seem to get anything to work.