1 year ago
#338377
James
SQL injection attack. Best possible defense review
For the last few days my logs have been revealing an attack on my system. I don't know what they are trying to accomplish? They seem to be attacking my style sheets only with GETS and POSTS to them.
the queries they are running are variations of this. ' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL# %' ORDER BY 9978# %' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#
Should I be concerned? what are they trying to access? How can I stop them from accessing whatever they are looking for? (I have prepared statements, so I am not too worried, but still just want to know so I can build the best defense possible.) Thank you in advance
LOG file
GET /styles.css?ts=1642369117%27%20ORDER%20BY%201%23 HTTP/1.0
GET /styles.css?ts=1642369117%27%20ORDER%20BY%201%23 HTTP/1.1
GET /styles.css?ts=1642369117%27%20ORDER%20BY%208912%23 HTTP/1.0
GET /styles.css?ts=1642369117%27%20ORDER%20BY%208912%23 HTTP/1.1
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%23 HTTP/1.0
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%23 HTTP/1.1
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%23 HTTP/1.0
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%23 HTTP/1.0
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%23 HTTP/1.1
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%23 HTTP/1.1
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.0
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.1
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.0
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.1
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.0
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.1
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.0
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.1
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.0
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.0
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.1
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.1
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.0
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.1
GET /styles.css?ts=1642369117%25%27%20ORDER%20BY%201%23 HTTP/1.0
GET /styles.css?ts=1642369117%25%27%20ORDER%20BY%201%23 HTTP/1.1
GET /styles.css?ts=1642369117%25%27%20ORDER%20BY%209978%23 HTTP/1.0
GET /styles.css?ts=1642369117%25%27%20ORDER%20BY%209978%23 HTTP/1.1
GET /styles.css?ts=1642369117%25%27%20UNION%20ALL%20SELECT%20NULL%23 HTTP/1.0
GET /styles.css?ts=1642369117%25%27%20UNION%20ALL%20SELECT%20NULL%23 HTTP/1.1
GET /styles.css?ts=1642369117%25%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%23 HTTP/1.0
GET /styles.css?ts=1642369117%25%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%23 HTTP/1.1
GET /styles.css?ts=1642369117%25%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%23 HTTP/1.0
GET /styles.css?ts=1642369117%25%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.0
GET /styles.css?ts=1642369117%25%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%23 HTTP/1.1
GET /styles.css?ts=1642369117%25%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.1
GET /styles.css?ts=1642369117%25%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.0
GET /styles.css?ts=1642369117%25%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.1
GET /styles.css?ts=1642369117%25%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.0
GET /styles.css?ts=1642369117%25%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.0
GET /styles.css?ts=1642369117%25%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.1
GET /styles.css?ts=1642369117%25%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.1
GET /styles.css?ts=1642369117%25%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.0
sql
code-injection
server-side-attacks
0 Answers
Your Answer