3

According to this SQL Injection Basics article:

<…> the operations mostly used for breaking\fuzzing the SQL query’s are.

  • ' Single quote
  • " Double Quote
  • \ Backslash (MySQL Escape character)

There also are hex-encoded characters (e.g. 0x3a3a) sometimes.

I want to log and drop all requests containing those. Here's where I am so far:

set $susp 0;
if ($request_uri ~ "%27") {
  set $susp 1;
}
location ~ \.php {
    if ($susp = 1) {
        access_log /var/log/nginx/for-review.log;
        return 500;
    }
    # further fastcgi configuration
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    fastcgi_pass unix:/var/run/php5-fpm.sock;
}

(I understand that if is evil, but it seemed necessary)

This fails to trigger on /foo/ba'r, but at least works fine on /?foo=b'ar. But that's it: the other characters I try aren't triggered either.

Here's what I've tried:

  • $request_uri ~ "%27|%22": single works, double doesn't
  • $request_uri ~ "%27|\"": single works, double doesn't
  • $request_uri ~ "%27|0x": both work, but 0x gets false positives on thumb=230x240

And I'm not even sure how do I approach the backslash.

Do you guys know how to make it work?

P.S. Thought about using Amazon WAS, but it requires another service (Cloudflare or load balancer) which I'm not yet ready for.

P.S. I realise that other measures need to be taken; this is supposed to drop those annoying GET scans. Also I doubt the legit visitors will end up having those while they're browsing. My logic was this: any barrier complicating the hack helps

mehov
  • 568
  • 1
  • 5
  • 14

1 Answers1

0

The main nginx.conf, under http {}:

# set the variable
map "$request_uri" $susp {
    default 0;
    "~*(?<suspm>(\\x|%)(3c|3e|5c|22|27)+)" 1;
}
# match logging
log_format suspl '$remote_addr /$suspm/ - $remote_user $host [$time_local] '
    '"$request" $status $body_bytes_sent '
    '"$http_referer" "$http_user_agent" "$http_cookie"';

Individual virtual host configuration:

location / {
    if (\$susp = 1) {
        access_log /var/log/suspl.log suspl;
        return 403;
    }
    # etc…
}

Also,

I doubt the legit visitors will end up having those while they're browsing

Heads up: turns out, they do carry something like %7B%22 in their cookies set by some (not all) tracking/analytics software.

mehov
  • 568
  • 1
  • 5
  • 14