Home / server / Questions / 1064812
In Process
alebal
Asked: 2021-05-27 13:29:01 +0800 CST

How to block mysql EXTRACTVALUE with fail2ban?

  • 772

How to block these with fail2ban?

45.154.255.147 - - [25/May/2021:08:32:40 -0700] "GET /search.php?q=xgp%2F%2A%2A%2Fbangla%2F%2A%2A%2Fcom%27%20PROCEDURE%20ANALYSE%28EXTRACTVALUE%281915%2CCONCAT%280x5c%2C0x71707a6271%2C%28SELECT%20%28CASE%20WHEN%20%281915%3D1915%29%20THEN%201%20ELSE%200%20END%29%29%2C0x7176767071%29%29%2C1%29%20AND%20%27uOyt%27%3D%27uOyt HTTP/1.1" 200 11884 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:2.0b11pre) Gecko/20110129 Firefox/4.0b11pre"
46.232.249.138 - - [25/May/2021:08:36:28 -0700] "GET /search.php?q=xgp%2F%2A%2A%2Fbangla%2F%2A%2A%2Fcom%27%29%20PROCEDURE%20ANALYSE%28EXTRACTVALUE%281915%2CCONCAT%280x5c%2C0x71707a6271%2C%28SELECT%20%28CASE%20WHEN%20%281915%3D1915%29%20THEN%201%20ELSE%200%20END%29%29%2C0x7176767071%29%29%2C1%29%20AND%20%28%27BInS%27%20LIKE%20%27BInS HTTP/1.1" 200 10092 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:2.0b11pre) Gecko/20110129 Firefox/4.0b11pre"
45.129.56.200 - - [25/May/2021:08:36:37 -0700] "GET /search.php?q=xgp%2F%2A%2A%2Fbangla%2F%2A%2A%2Fcom%27%20PROCEDURE%20ANALYSE%28EXTRACTVALUE%281915%2CCONCAT%280x5c%2C0x71707a6271%2C%28SELECT%20%28CASE%20WHEN%20%281915%3D1915%29%20THEN%201%20ELSE%200%20END%29%29%2C0x7176767071%29%29%2C1%29%20AND%20%27htVh%27%20LIKE%20%27htVh HTTP/1.1" 200 11910 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:2.0b11pre) Gecko/20110129 Firefox/4.0b11pre"
23.129.64.232 - - [25/May/2021:08:36:39 -0700] "GET /search.php?q=xgp%2F%2A%2A%2Fbangla%2F%2A%2A%2Fcom%22%29%20PROCEDURE%20ANALYSE%28EXTRACTVALUE%281915%2CCONCAT%280x5c%2C0x71707a6271%2C%28SELECT%20%28CASE%20WHEN%20%281915%3D1915%29%20THEN%201%20ELSE%200%20END%29%29%2C0x7176767071%29%29%2C1%29%20AND%20%28%22CSNy%22%3D%22CSNy HTTP/1.1" 200 10054 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:2.0b11pre) Gecko/20110129 Firefox/4.0b11pre"
23.129.64.232 - - [25/May/2021:08:36:45 -0700] "GET /search.php?q=xgp%2F%2A%2A%2Fbangla%2F%2A%2A%2Fcom%22%20PROCEDURE%20ANALYSE%28EXTRACTVALUE%281915%2CCONCAT%280x5c%2C0x71707a6271%2C%28SELECT%20%28CASE%20WHEN%20%281915%3D1915%29%20THEN%201%20ELSE%200%20END%29%29%2C0x7176767071%29%29%2C1%29%20AND%20%22NYRo%22%3D%22NYRo HTTP/1.1" 200 10043 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:2.0b11pre) Gecko/20110129 Firefox/4.0b11pre"

Founded with this:

sudo grep "EXTRACTVALUE"  /var/log/httpd/access.log
fail2ban

1 Answers

  1. Well, the regex may be something like this:

    ^<ADDR> \S+ \S+ \[\] "GET /search\.php\?[^"]*EXTRACTVALUE[^"]*"

    But it is not advisable to do something like this:

    • service seems to response with 200 now, so it looks like valid request for that (no parameter validation?);
    • it may affect legitimate users (accidentally sending in query some "evil" word);
    • it can be simple for intruder to avoid the ban, by changing sql statement (switch to other functions, split EXTRACTVALUE in two words, switch to POST http-method containing q argument, which is not logged, etc);
    • correct prevention against SQL injections makes such "attacks" senseless and useless

    If really needed, better would be to prevent such "attack" on service side (e. g. in search.php or in API it is using) and do response with 50x code on such URL parameters by its validation. Then a fail2ban filter checking 50x code could ban it also.

    • 0