1

I am attempting to ban a specific url in my jail.local configuration. The url is

Add_Product.php?union+select <-- Lots more follows this

ERROR  NOK: ('Unable to compile regular expression \'^(?:::f{4,6}:)?(?P<host>[\\w\\-.^_]*\\w) -.*"(GET|POST).*/Add_Product.php?*union+select\'',)

This url doesn't actually exist. We don't even run this query in our databases.

Here is the rule in my jail.local

[sql-union-select-attack]
enabled = true
filter = sql-union-select-attack
logpath = /var/log/nginx/*access.log
maxretry = 1
findtime = 10
bantime = 60000

Here is the rule in my filter.d/sql-union-select-attack.conf

#The SQL Injection attempt with "union+select+" in the URL     
[Definition]
failregex = ^<HOST> -.*"(GET|POST).*/Add_Product.php?*union+select+0x5e2526
ignoreregex =

Do I have a syntax error in my jail rule? I tried to use this question as a reference since I needed something similar. This attack attempt is bogging down my server.

Thank you.

13
  • 1
    Did you try plugging it in at regex101.com? It points out the syntax error in your regex. – Michael Hampton Oct 18 '18 at 13:42
  • The error it is showing is "* The preceding token is not quantifiable" – DevOpsSauce Oct 18 '18 at 14:03
  • That's correct, you can't have zero or more of a ? as that character is also special. It's not clear why you have the * there. – Michael Hampton Oct 18 '18 at 14:04
  • I'm trying to capture anything after Add_Product.php? and before union+select. There are id numbers after the php query string, and they're always different. – DevOpsSauce Oct 18 '18 at 14:08
  • Then you probably meant to use .* – Michael Hampton Oct 18 '18 at 14:14
1

This fixed my problem. I tested on a VM and it dropped my connection successfully.

failregex = ^\d{4} <HOST> -.*\"(GET|POST).*Add_Product.php.*union+select

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.