Suspicious entries in MySQL database from user input forms - sql injection?

Question

I built a website from scratch using PHP and MySQL for my residential community and our budget is a big fat '0'.

Five days ago I discovered that there were 222 entries in a table in my database that looked suspicious. The I found another 196 entries in another table with similar entries. All these entries had been made within a 11 hour span.

Since then I have been breaking my head trying to 1. find ways of preventing such things from happening - basically trying to learn and convert my PHP to MySQLi (my host does not support PDO) and 2. trying to find out for sure whether this is an SQL injection attack. 3. the Apache log for the relevant day had a 4976Kb size whereas, all other days it is less than 50Kb 4. I have also taken a dump of one of the tables (222 records).

• What I would like to know is, which of these is the first place to visit?
• Do I study the logs first to try and find out what they got out of this exercise?
• Do I study the table entries to find out how they did it?
• Do I take down the site?
• Do I flush my tables, change existing passwords etc? (luckily, since this site had not been 'launched', there is no data that I need to preserve - I can simply flush all tables!)

Searching on SE has given me a lot to think about especially https://serverfault.com/questions/218005/how-do-i-deal-with-a-compromised-server and RobM's answer made perfect sense.

I don't know the implications of what I see in my tables. Some of the entries are not displayed in the preview - obviously because it contains special characters. I'd have loved to be able to upload the excel dump of the table in question but that doesn't seem to be possible here...

I don't want to remove these entries before I can understand what they could mean and how much I am compromised. At the same time, I am not sure whether leaving them there can cause me further harm....

Answer 1

You might have been subjected to the process called "Fuzzing". This is when an attacker submits many inputs and perceives how your web application behaves. Web Fuzzing could include sql injection, XSS, overladed input or invalid input strings in general.

Well first you need to look at the entries.. Do they contain SQL commands? like SELECT, UPDATE, DELETE, INSERT
or sql operators, such as OR + - or many sql characters such as ' > < = "

If u see them, then it means that the hacker tried an SQL injection on your database.

If you see any html characters in your database, the attacker tried to execute stored XSS against you.

If the inputs are long, the attacker tried perhaps to DOS your website and bring it down. (Same is true if he submitted a lot of input in short time).

You need to observe the functionality of your site which accepted those values. If the entries/inputs didnt come from a specific functionality (e.g. registration form) than it was probably a hacking attempt.

Other types of injections that exit are LDAP, XML, Command and a few more that i cant remember. Look for characters that contain the following: % , > , ( , ) , ", ', dots , commas.

You can test it with mysql commands/operators: 1) LIKE '%searchStringGoesHere%' 2) MATCH AGAINST.

Panels like phpmyadmin, provides the same functionality but for people who dont know the sql language.

Alternatively, someone might have run some SEO bot on your site, and that was a spam attack, which is not much to do with security, but you could introduce captcha on your forms and tokens per each request to prevent a XSRF attack

Answer 2

Do two things immediately. (1) walk through your code and make sure all inputs used to construct queries are quoted or otherwise re-interpreted rather than used directly to construct queries. If you have cases where that's hard to do, suck it up, there is no substitute. (2) centalize all your queries through a filter that logs ANY query that fails. This will likely tell you where (1) was unsuccessful.