1

I am attempting to ban a specific url in my jail.local configuration. The url is

Add_Product.php?union+select <-- Lots more follows this

ERROR  NOK: ('Unable to compile regular expression \'^(?:::f{4,6}:)?(?P<host>[\\w\\-.^_]*\\w) -.*"(GET|POST).*/Add_Product.php?*union+select\'',)

This url doesn't actually exist. We don't even run this query in our databases.

Here is the rule in my jail.local

[sql-union-select-attack]
enabled = true
filter = sql-union-select-attack
logpath = /var/log/nginx/*access.log
maxretry = 1
findtime = 10
bantime = 60000

Here is the rule in my filter.d/sql-union-select-attack.conf

#The SQL Injection attempt with "union+select+" in the URL     
[Definition]
failregex = ^<HOST> -.*"(GET|POST).*/Add_Product.php?*union+select+0x5e2526
ignoreregex =

Do I have a syntax error in my jail rule? I tried to use this question as a reference since I needed something similar. This attack attempt is bogging down my server.

Thank you.

13
  • 1
    Did you try plugging it in at regex101.com? It points out the syntax error in your regex. Commented Oct 18, 2018 at 13:42
  • The error it is showing is "* The preceding token is not quantifiable" Commented Oct 18, 2018 at 14:03
  • That's correct, you can't have zero or more of a ? as that character is also special. It's not clear why you have the * there. Commented Oct 18, 2018 at 14:04
  • I'm trying to capture anything after Add_Product.php? and before union+select. There are id numbers after the php query string, and they're always different. Commented Oct 18, 2018 at 14:08
  • Then you probably meant to use .* Commented Oct 18, 2018 at 14:14

1 Answer 1

1

This fixed my problem. I tested on a VM and it dropped my connection successfully.

failregex = ^\d{4} <HOST> -.*\"(GET|POST).*Add_Product.php.*union+select

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .