1

I am attempting to ban a specific url in my jail.local configuration. The url is 

Add_Product.php?union+select <-- Lots more follows this

ERROR  NOK: ('Unable to compile regular expression \'^(?:::f{4,6}:)?(?P<host>[\\w\\-.^_]*\\w) -.*"(GET|POST).*/Add_Product.php?*union+select\'',)

This url doesn't actually exist. We don't even run this query in our databases.

Here is the rule in my jail.local

[sql-union-select-attack]
enabled = true
filter = sql-union-select-attack
logpath = /var/log/nginx/*access.log
maxretry = 1
findtime = 10
bantime = 60000

Here is the rule in my filter.d/sql-union-select-attack.conf

#The SQL Injection attempt with "union+select+" in the URL     
[Definition]
failregex = ^<HOST> -.*"(GET|POST).*/Add_Product.php?*union+select+0x5e2526
ignoreregex =

Do I have a syntax error in my jail rule? I tried to use this question as a reference since I needed something similar. This attack attempt is bogging down my server.

Thank you.

Improve this question
13
  • 1
    Did you try plugging it in at regex101.com? It points out the syntax error in your regex.
    – Michael Hampton
    Oct 18, 2018 at 13:42
  • The error it is showing is "* The preceding token is not quantifiable"
    – DevOpsSauce
    Oct 18, 2018 at 14:03
  • That's correct, you can't have zero or more of a ? as that character is also special. It's not clear why you have the * there.
    – Michael Hampton
    Oct 18, 2018 at 14:04
  • I'm trying to capture anything after Add_Product.php? and before union+select. There are id numbers after the php query string, and they're always different.
    – DevOpsSauce
    Oct 18, 2018 at 14:08
  • Then you probably meant to use .*
    – Michael Hampton
    Oct 18, 2018 at 14:14

1 Answer 1

Reset to default
1

This fixed my problem. I tested on a VM and it dropped my connection successfully. 

failregex = ^\d{4} <HOST> -.*\"(GET|POST).*Add_Product.php.*union+select
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.