I just stumbled on a website vulnerable to an SQL injection attack by mistake ( https://stackoverflow.com/questions/6181248/is-this-site-vulnerable-to-an-sql-injection-attack ).

That made me curious about what is tried and how often an attack attempt comes by on some website.

So I'm thinking it would be cool to setup a honeypot on my server to see if / how often / using what techniques 'crackers' try to get access to my SQL data.

There are some basic things I can think of to lure them, like:

/login.php / asp url

/adminlogin.php / asp url

A searchform

?id=111 url

with some fake SQL errors when trying to inject some SQL.

Anybody has some more / better suggestion / ideas / whatever to set up a honeypot for SQL injection?

  • How do you stumble upon a 'website vulnerable to an SQL injection attack by mistake'? That's like saying I was walking in a parking lot and just found a car with a purse in the glovebox. Seems to me like you were fishing... Commented May 1, 2014 at 17:42

3 Answers 3


May I suggest some honeypots designed for things exactly like what you describe:


The best way to address the problem of sql injection is to use parametrized queries, which can be done with a library like PDO or MySQLi. You must actually patch vulnerabilities in your web application. I recommend using a free service like Sitewatch or an open source tool like wapiti. These solutions will detect a lot more than just sql injection in your application.

If you want to lock down a potentially insecure web application than you should use a Web Application Firewall or WAF. Mod_Security is a great choice, its free and open source. But this isn't a substitution for known vulnerabilities, it is just another layer.

WAF's are composed of thousands of regular expressions and they looking for nasty input. They can be configured to log attacks or drop the request before it touches your web application. This goes beyond just SQL Injection and XSS and looks at many different types of web application attacks such as the ones covered in the OWASP top 10.

  • 1
    @Rook, nice as all these tools are, best way to patch SQL-injections is to: 1. only use PDO to connect to a database. 2. don't use dynamic database, table or column names ever 3. don't use dynamic SQL statements like ASC or DESC. 4. If you must do (2) or (3) check these things in a whitelist and only inject them into the SQL statement if they are listed in the pre-approved whitelist. 5. Never echo errors from the database to the client.
    – Johan
    Commented May 31, 2011 at 22:19
  • 1
    @Johan yeah I agree and if you are building an app from scratch you should do all of that. However if the app is already written then it might be very expensive to perform this rewrite. It should also be noted that vulnerability scanners and waf's address a lot more than just sql injection.
    – rook
    Commented May 31, 2011 at 23:05
  • 3
    I'm curious, this really is not answering the question that was asked...??
    – AviD
    Commented Jun 5, 2011 at 19:57
  • @AviD♦ I disagree. The motive of the OP is to secure his app, I informing him of how it should be done. However you are welcome to disagree.
    – rook
    Commented Jun 6, 2011 at 3:16
  • 3
    @Rook did you read the question? No where did he ask about how to secure his app, no need for condescension. The OP was explicitly and clearly asking for tips on setting up a honeypot.
    – AviD
    Commented Jun 6, 2011 at 7:38

I found a very amusing example of a honeypot here.

It doesn't use SQL or any SQL server at all, but just this php code:

// SQL Injection 'TEST'
if( strpos($username,"'") !== false || strpos($password,"'") !== false )
    $sqlInjectionError = "
            <p><font size=2>Microsoft ODBC MySQL Drivers Message:</font></p>
            <p><B>Error in the query:</B></p>
            <p>[Microsoft:ODBC 1045] SELECT UlluKaPatha FROM UlluKePathay WHERE
            GadhayKaRollNo = '".$_POST['username']."' 
            AND GadhayKaPassword = '".$_POST['password']."'
// End SQL Injection 'TEST'

e.g. if someone provided username admin and password x' OR '1'='1, he she got the response:

Microsoft ODBC MySQL Drivers Message:

Error in the query: [Microsoft:ODBC 1045] SELECT UlluKaPatha FROM UlluKePathay WHERE GadhayKaRollNo = 'admin' AND GadhayKaPassword = 'x' OR '1'='1'

If you log the input (in a secure way) into a database, it might make interesting statistics about which attacks are used on an unsecured system.

  • 1
    +1. I couldn't help chuckle at this. For those who don't understand the SQL query, the native english version translations are: UlluKaPatha = Son of an owl, UlluKePathay= Sons of owls, GadhayKaRollNo = Donkey's roll no, GadhayKaPassword = Donkey's Password Commented May 31, 2011 at 20:38
  • 4
    -1 This is vulnerable to XSS. You are just introducing a real vulnerability. Also, this is very obviously a fake. What if the string ended in a `` or you tried to sleep.
    – rook
    Commented May 31, 2011 at 20:51
  • 1
    @Rook, good point about the XSS, but the string only gets send back to the attacker, you are not putting it on a public forum, so how does the XSS spread to anyone but the attacker?
    – Johan
    Commented May 31, 2011 at 21:16
  • 4
    This is a very exploitable reflective xss vulnerability. To exploit this issue the attacker would create a <form> that has a post variable username=<script>alert('xss')</script> The single quotes around the alert statement is enough to trip the fake error. The attacker would use a javascript .submit() to automatically submit the forum after he has gotten his victim to click on a link.
    – rook
    Commented May 31, 2011 at 21:24
  • 2
    @Rook, I think you missed the point of the question in the first place - this is an intentionally vulnerable app, intended to serve as a honeypot. That was the actual question. +1.
    – AviD
    Commented Jun 5, 2011 at 20:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .