1

Someone is trying to SQLi my domain using sqlmap. I'm getting a lot of errors from mysql.

My server access log shows:

- - HTTP/1.1" 200 10559 "-" "sqlmap/1.0.4.0#dev (http://sqlmap.org)"

I have tried blocking the IP but the IP keeps changing. How to block sqlmap from server?

  • Could you provide some more log files for us to look at? A pastebin will do – thel3l Jan 31 '17 at 6:50
2

You can do an agent check, which will stop those who are dumb enough not to change the agent - block any request with an agent string that includes 'sqlmap'

However, I will note that if you are actually getting SQL errors, that is a sign that you may be vulnerable to SQL Injection. If you are properly using parameterized queries / DAOs / PDOs, you should not get a SQL error. An attacker should never be able to get your SQL to error - if they can, they may be able to change its execution.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.