Home page logo
/

pen-test logo Penetration Testing mailing list archives

Re: Looking for help against Chinese Hacking Team
From: David Howe <DaveHowe.Pentest () googlemail com>
Date: Thu, 18 Dec 2008 15:00:26 +0000

Mike wrote:
On Dec 16, 2008, at 5:53 AM, Adriel T. Desautels wrote:

If he's looking to stop attacks then he needs to remove the vector
through which he is being attacked. IPS devices do not remove the
vector, they make an attempt to prevent the vector from being
accessed. While I support the use of properly configured and
maintained IPS technologies, I'd never recommend using them as a
method for remediation because they are only a method for
mitigation.  Sure mitigation is great, but its not a fix.


A lot of good advice has been offered, but in order to spot what
happened, somebody will have to examine the web server logs to look
for evidence of SQL injection or whatever method was used to exploit
the application.

With that in mind, here are some examples of SQL injection that might
be useful (from Apache logs):

atta.cker.ip.address www.vulnerableserver.com - [13/Apr/
2008:04:23:43-0800] "GET /index.php?go=detail&id=-99999/**/union/**/
select/**/0,0,0,0,0,0,0,0,0,0,0x7c,email,0x3a,concat(username,
0x3a,password),1,1,1,1,1,1,2,2,2,2,2/**/from/*http://www.hackedserver.com/html/images/idd.txt?
??? HTTP/1.1" 200 63919 "-" "libwww-perl/5.811"

atta.cker.ip.address  - - [13/Apr/2008:04:23:43 -0800] "GET /?
article=63+and+(select+ascii(substring(cast(+table%5fname+as+char),
+3,+1))%2616+from+information%5fschema.tables+where+table%5ftype+%3c%3e
+(concat(char(118),char(105),char(101),char(119)))+and+1=1++limit
+1)HTTP/1.0" 200 53604 "-" "Opera/9.23 (Windows NT 5.1; U; en)"

I find most injection attacks these days attempt to use cloaking
techniques - hence you should look for patterns like using the cast
function on a large hex block, then the exec function...

simpler yet, almost no valid log entries should have -- or ; in them;
few should have single quotes, either.

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Security Trends Report from Cenzic
Stay Ahead of the Hacker Curve!
Get the latest Q2 2008 Trends Report now

www.cenzic.com/landing/trends-report
------------------------------------------------------------------------


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault