1

Today in the apache access log I saw something like this

https://xxxxx/xxxx/xx/something.html' or (1,2)=(select*from(select name_const(CHAR(103,119,111,107,69,82,84,99,118),1),name_const(CHAR(103,119,111,107,69,82,84,99,118),1))a) -- 'x'='x.html

t's an SQL injection attack but I am not able to figure out what the attacker trying to do.

And also the ascii Representation of the characters correspond to "gwokERTcv" what does this mean?

  • Missing some important context. What exactly is that string? For example, is it contained in the URL that the hacker posted to your web server? Is it a string that he typed into the UserName textbox on the login page? – John Wu Jan 12 at 1:27
  • Which string are you referring to? – karthick Jan 12 at 2:19
  • The attack. The string that you put in the gray box. – John Wu Jan 12 at 2:55
  • something.html is the the html file name and "gwokERTcv" is the char array 103,119,111,107,69,82,84,99,118 present. I will rephrase the question – karthick Jan 12 at 2:56
  • that is the apache access log. I am just showing only the url which was captured – karthick Jan 12 at 3:00
2

This is a pretty basic scan attack that can determine a couple of things on your system without much effort.

  1. Is your system running MySQL
  2. Will your system parse the SQL statement and return a value.

If your server responds appropriately to the command, the attacker knows that they can manipulate your database and potential exploit your system. Uh oh.

The good news is this is just a scan. Take it, see if you can make the command work on your own and learn how they want to attack from there.

More information on this can be seen here:

https://firegenanalytics.com/2017/12/splunk-review-121017/

-- Edit --

I just wanted to point out that they weren't trying to get anything from your database. They just attempted to create a temp table with some columns and values for their temp table to perform a command assessment. The values don't really mean anything.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.