How to best limit SQL injection attacks that are being funneled through an Apache proxy I control

Question

I use an Apache proxy to funnel traffic to an IIS server. The IIS server sends me emails if some bad actor attacks my site with an sql injection attack. It captures their IP address, and sends me the URL that was used.

The other day I got 8,400 emails in 50 minutes, nothing my mail server can't handle, but all from some IP proxy in the US.

Now I am thinking of hardening my code by adding some time sensitive (hindering) factor into the equation. The idea is to send them a redirect to somewhere else (fbi?) for a set time period, after an initial warning; provided they reach that emails code.

Should I have IIS handle this (simple to implement,) or is it better for Apache to handled it? I would think so it there is such a function in Apache.

In IIS I could start a session logging IP addresses of bad actors, and block their access to the site. Or has Apache something that could block these request for a set time period?

And how would I implement this IIS to Apache handover, maybe via some header?

Answer 1

Now I am thinking of hardening my code by adding some time sensitive (hindering) factor into the equation. The idea is to send them a redirect to somewhere else (fbi?) for a set time period, after an initial warning; provided they reach that emails code.

Most attacks are automated, so it's likely that your warning will not be seen or taken into consideration. Besides, the bad actors should normally be hiding their real IP address and using some proxy/VPN.

If I understand this right, the Apache server acts as some sort of reverse proxy. I would set up the front-line defense on the Apache server first instead of the IIS server.

What I would do is simply block the IP addresses at firewall level, automatically. In Linux this can be done with tools like Fail2Ban or CSF+LFD. These tools work by watching log files in real time and add firewall rules to ban offenders from making any further connections until the ban expires. They are mostly used to watch failed SSH attempts but also monitor other services such as POP/IMAP/SMTP/FTP etc.

You may need to add a custom rule and point to a specific log file but that shouldn't be too difficult.

Plus, Apache has a WAF module AFAIK. There may be some tools already available for the purpose.

Bottom line: don't contain the attackers, block them. You can have fun with the wannabe hackers and frustrate their efforts but I feel that blocking them is more straightforward and will save server and network resources.

At some point, your server may have to handle hundreds or thousands of concurrent malicious requests and your server could literally be overwhelmed fending off the attacks.