Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I just stumbled on a website vulnerable to an SQL injection attack by mistake ( http://stackoverflow.com/questions/6181248/is-this-site-vulnerable-to-an-sql-injection-attack ).

That made me curious about what is tried and how often an attack attempt comes by on some website.

So I'm thinking it would be cool to setup a honeypot on my server to see if / how often / using what techniques 'crackers' try to get access to my SQL data.

There are some basic things I can think of to lure them, like:

/login.php / asp url

/adminlogin.php / asp url

A searchform

?id=111 url

with some fake SQL errors when trying to inject some SQL.

Anybody has some more / better suggestion / ideas / whatever to set up a honeypot for SQL injection?

share|improve this question
add comment

3 Answers

up vote 9 down vote accepted

May I suggest some honeypots designed for things exactly like what you describe:

share|improve this answer
add comment

I found a very amusing example of a honeypot here.
http://www.sharjeel.2scomplement.com/sql-injection-honeypots

It doesn't use SQL or any SQL server at all, but just this php code:

// SQL Injection 'TEST'
if( strpos($username,"'") !== false || strpos($password,"'") !== false )
{
    $sqlInjectionError = "
            <p><font size=2>Microsoft ODBC MySQL Drivers Message:</font></p>
            <p><B>Error in the query:</B></p>
            <p>[Microsoft:ODBC 1045] SELECT UlluKaPatha FROM UlluKePathay WHERE
            GadhayKaRollNo = '".$_POST['username']."' 
            AND GadhayKaPassword = '".$_POST['password']."'
            ";
}
// End SQL Injection 'TEST'

e.g. if someone provided username admin and password x' OR '1'='1, he she got the response:

Microsoft ODBC MySQL Drivers Message:

Error in the query: [Microsoft:ODBC 1045] SELECT UlluKaPatha FROM UlluKePathay WHERE GadhayKaRollNo = 'admin' AND GadhayKaPassword = 'x' OR '1'='1'

If you log the input (in a secure way) into a database, it might make interesting statistics about which attacks are used on an unsecured system.

share|improve this answer
1  
+1. I couldn't help chuckle at this. For those who don't understand the SQL query, the native english version translations are: UlluKaPatha = Son of an owl, UlluKePathay= Sons of owls, GadhayKaRollNo = Donkey's roll no, GadhayKaPassword = Donkey's Password –  Vineet Reynolds May 31 '11 at 20:38
4  
-1 This is vulnerable to XSS. You are just introducing a real vulnerability. Also, this is very obviously a fake. What if the string ended in a `` or you tried to sleep. –  Rook May 31 '11 at 20:51
1  
@Rook, good point about the XSS, but the string only gets send back to the attacker, you are not putting it on a public forum, so how does the XSS spread to anyone but the attacker? –  Johan May 31 '11 at 21:16
4  
This is a very exploitable reflective xss vulnerability. To exploit this issue the attacker would create a <form> that has a post variable username=<script>alert('xss')</script> The single quotes around the alert statement is enough to trip the fake error. The attacker would use a javascript .submit() to automatically submit the forum after he has gotten his victim to click on a link. –  Rook May 31 '11 at 21:24
2  
@Rook, I think you missed the point of the question in the first place - this is an intentionally vulnerable app, intended to serve as a honeypot. That was the actual question. +1. –  AviD Jun 5 '11 at 20:01
add comment

The best way to address the problem of sql injection is to use parametrized queries, which can be done with a library like PDO or MySQLi. You must actually patch vulnerabilities in your web application. I recommend using a free service like Sitewatch or an open source tool like wapiti. These solutions will detect a lot more than just sql injection in your application.

If you want to lock down a potentially insecure web application than you should use a Web Application Firewall or WAF. Mod_Security is a great choice, its free and open source. But this isn't a substitution for known vulnerabilities, it is just another layer.

WAF's are composed of thousands of regular expressions and they looking for nasty input. They can be configured to log attacks or drop the request before it touches your web application. This goes beyond just SQL Injection and XSS and looks at many different types of web application attacks such as the ones covered in the OWASP top 10.

share|improve this answer
1  
@Rook, nice as all these tools are, best way to patch SQL-injections is to: 1. only use PDO to connect to a database. 2. don't use dynamic database, table or column names ever 3. don't use dynamic SQL statements like ASC or DESC. 4. If you must do (2) or (3) check these things in a whitelist and only inject them into the SQL statement if they are listed in the pre-approved whitelist. 5. Never echo errors from the database to the client. –  Johan May 31 '11 at 22:19
1  
@Johan yeah I agree and if you are building an app from scratch you should do all of that. However if the app is already written then it might be very expensive to perform this rewrite. It should also be noted that vulnerability scanners and waf's address a lot more than just sql injection. –  Rook May 31 '11 at 23:05
3  
I'm curious, this really is not answering the question that was asked...?? –  AviD Jun 5 '11 at 19:57
    
@AviD♦ I disagree. The motive of the OP is to secure his app, I informing him of how it should be done. However you are welcome to disagree. –  Rook Jun 6 '11 at 3:16
3  
@Rook did you read the question? No where did he ask about how to secure his app, no need for condescension. The OP was explicitly and clearly asking for tips on setting up a honeypot. –  AviD Jun 6 '11 at 7:38
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.