Suggestion setting up a SQL injection honeypot

Question

I just stumbled on a website vulnerable to an SQL injection attack by mistake ( http://stackoverflow.com/questions/6181248/is-this-site-vulnerable-to-an-sql-injection-attack ).

That made me curious about what is tried and how often an attack attempt comes by on some website.

So I'm thinking it would be cool to setup a honeypot on my server to see if / how often / using what techniques 'crackers' try to get access to my SQL data.

There are some basic things I can think of to lure them, like:

/login.php / asp url

/adminlogin.php / asp url

A searchform

?id=111 url

with some fake SQL errors when trying to inject some SQL.

Anybody has some more / better suggestion / ideas / whatever to set up a honeypot for SQL injection?

Answer 1

May I suggest some honeypots designed for things exactly like what you describe:

• WebLabyrinth ( info )

• Glastopf

• DShield Web Honeypot Project

Answer 2

The best way to address the problem of sql injection is to use parametrized queries, which can be done with a library like PDO or MySQLi. You must actually patch vulnerabilities in your web application. I recommend using a free service like Sitewatch or an open source tool like wapiti. These solutions will detect a lot more than just sql injection in your application.

If you want to lock down a potentially insecure web application than you should use a Web Application Firewall or WAF. Mod_Security is a great choice, its free and open source. But this isn't a substitution for known vulnerabilities, it is just another layer.

WAF's are composed of thousands of regular expressions and they looking for nasty input. They can be configured to log attacks or drop the request before it touches your web application. This goes beyond just SQL Injection and XSS and looks at many different types of web application attacks such as the ones covered in the OWASP top 10.

Answer 3

I found a very amusing example of a honeypot here.
http://www.sharjeel.2scomplement.com/sql-injection-honeypots

It doesn't use SQL or any SQL server at all, but just this php code:

// SQL Injection 'TEST'
if( strpos($username,"'") !== false || strpos($password,"'") !== false )
{
    $sqlInjectionError = "
            <p><font size=2>Microsoft ODBC MySQL Drivers Message:</font></p>
            <p><B>Error in the query:</B></p>
            <p>[Microsoft:ODBC 1045] SELECT UlluKaPatha FROM UlluKePathay WHERE
            GadhayKaRollNo = '".$_POST['username']."' 
            AND GadhayKaPassword = '".$_POST['password']."'
            ";
}
// End SQL Injection 'TEST'

e.g. if someone provided username admin and password x' OR '1'='1, he she got the response:

Microsoft ODBC MySQL Drivers Message:

Error in the query: [Microsoft:ODBC 1045] SELECT UlluKaPatha FROM UlluKePathay WHERE GadhayKaRollNo = 'admin' AND GadhayKaPassword = 'x' OR '1'='1'

If you log the input (in a secure way) into a database, it might make interesting statistics about which attacks are used on an unsecured system.