5

I've had an attacker try to gain access to one of my websites through a form using what looks like a blind SQL inject. It is a huge form, and every possible permutation of values has been tried - in total about 18000 of them.

He hasn't had any success (yay!), but I'm left with a bit of a puzzle: there are no unusual requests logged in the IIS logs. Nothing out of the ordinary.

I was reading https://serverfault.com/questions/364186/when-does-iis-log-a-request , and I wondered: Could an attacker purposefully prevent his requests from being logged? For instance, by sending the request and then dropping the connection before the response is sent (completely)?

  • ...so you've identified a gap in your ability to detect an attempted attack (yay!) – symcbean Mar 24 '15 at 13:05
1

You will not see the payload in the logs If the attacks were sent via a POST, as opposed to a GET.

0

As far as I know there is no way to avoid being logged by the web server exploiting a SQLi vulnerability since you have to reach the DB and check webserver output in order to validate SQLi result, specially in a blind SQL injection.

Also if you registered 18000 requests from the attacker he should be using an automated tool which use to check web page output to validate success or failure of the injection.

The only way for an attacker to clear the logs is owning the server and cleaning them "manually".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.