I've had an attacker try to gain access to one of my websites through a form using what looks like a blind SQL inject. It is a huge form, and every possible permutation of values has been tried - in total about 18000 of them.

He hasn't had any success (yay!), but I'm left with a bit of a puzzle: there are no unusual requests logged in the IIS logs. Nothing out of the ordinary.

I was reading https://serverfault.com/questions/364186/when-does-iis-log-a-request , and I wondered: Could an attacker purposefully prevent his requests from being logged? For instance, by sending the request and then dropping the connection before the response is sent (completely)?

  • ...so you've identified a gap in your ability to detect an attempted attack (yay!)
    – symcbean
    Commented Mar 24, 2015 at 13:05

2 Answers 2


You will not see the payload in the logs If the attacks were sent via a POST, as opposed to a GET.


As far as I know there is no way to avoid being logged by the web server exploiting a SQLi vulnerability since you have to reach the DB and check webserver output in order to validate SQLi result, specially in a blind SQL injection.

Also if you registered 18000 requests from the attacker he should be using an automated tool which use to check web page output to validate success or failure of the injection.

The only way for an attacker to clear the logs is owning the server and cleaning them "manually".

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .