这篇文章介绍了当WordPress开启错误记录以后，根据error_log来发现SQL注入攻击的思路。 ) T6 B1 P, d8 U, R( S/ e: X8 f1 F, V) i ' b( d9 m& b7 h吸引Cocoa的是这个博客其实是TrustWave公司下属的一个叫Spiderlab团队的官方博客，貌似比较有意思。例如它提到了Honeypot Alert这个标签里的文章都是分析他们一个Web蜜罐的Apache access_log日志的。 2 w) R% z, G6 `/ ~. Q; _: |/ y" O3 ?1 J
简单介绍一下这篇文章吧。 ) a/ p3 E1 c0 z& K/ A5 e % C: f E' f, ]0 u开启WP错误记录功能 , w/ H" q: X, R! ]0 b5 P" ~只需要修改wp-config.php的如下几行： / O; U( p1 ^3 g. {; j4 E8 m8 N/ b( ~* Y. x C6 X6 b
@ini_set('log_errors','On'); @ini_set('display_errors','Off'); @ini_set('error_log','/home/example.com/logs/php_error.log');SQL 注入扫描9 l4 Q5 U2 q0 U; Y
9 d; E: M& f0 s. t) [# |5 X[07-Dec-2012 02:40:49] WordPress database error You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'WHERE id = -1\'' at line 1 for query SELECT text, author_id, date FROM WHERE id = -1\' " `& v; H9 d% r, }4 Q3 O- p+ v[07-Dec-2012 02:40:50] WordPress database error You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'WHERE id = 999999.9 UNION ALL SELECT 0x31303235343830303536--' at line 1 for query SELECT text, author_id, date FROM WHERE id = 999999.9 UNION ALL SELECT 0x31303235343830303536--% ?% e/ B6 R* J; A: ^- H# l8 `8 v9 J
[07-Dec-2012 02:40:53] WordPress database error You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'WHERE id = 999999.9 UNION ALL SELECT 0x31303235343830303536,0x313032353438303035' at line 1 for query SELECT text, author_id, date FROM WHERE id = 999999.9 UNION ALL SELECT 0x31303235343830303536,0x31303235343830303536-- k% N; G4 p- T/ h3 J( x
上面的日志就是在暴力猜解表的列数，那个巨大的十六进制值会被解析成null。 , ]7 [' M; n% f/ f, Z7 O( PSQL盲注扫描" o( [# u1 c; b
攻击者使用了类似"waitfor delay"和"benchmark"这样的函数来盲注。' `" c% n: X# x( K
2 }# }( o% v6 R! ]/ I
[07-Dec-2012 02:43:21] WordPress database error You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'WHERE id = -1; if (1=1) waitfor delay \'00:00:05\'--' at line 1 for query SELECT text, author_id, date FROM WHERE id = -1; if (1=1) waitfor delay \'00:00:05\'--; M# D3 p- S8 k1 @/ z* ?
[07-Dec-2012 02:43:27] WordPress database error You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'WHERE id = -1 and if(1=1,BENCHMARK(8623333,MD5(0x41)),0)' at line 1 for query SELECT text, author_id, date FROM WHERE id = -1 and if(1=1,BENCHMARK(8623333,MD5(0x41)),0)) H! s8 o; F, \
Google一下大规模扫描# J2 Z% n8 }: m/ e: h" I# Q
^4 d5 u) m; O5 J+ ?/ }7 g' W