1

Someone is trying to SQLi my domain using sqlmap. I'm getting a lot of errors from mysql.

My server access log shows:

- - HTTP/1.1" 200 10559 "-" "sqlmap/1.0.4.0#dev (http://sqlmap.org)"

I have tried blocking the IP but the IP keeps changing. How to block sqlmap from server?

1
  • Could you provide some more log files for us to look at? A pastebin will do
    – thel3l
    Jan 31, 2017 at 6:50

1 Answer 1

2

You can do an agent check, which will stop those who are dumb enough not to change the agent - block any request with an agent string that includes 'sqlmap'

However, I will note that if you are actually getting SQL errors, that is a sign that you may be vulnerable to SQL Injection. If you are properly using parameterized queries / DAOs / PDOs, you should not get a SQL error. An attacker should never be able to get your SQL to error - if they can, they may be able to change its execution.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .