|
|
- 这篇文章介绍了当WordPress开启错误记录以后,根据error_log来发现SQL注入攻击的思路。) r% d+ r* r: ]
7 x0 I# ^2 Y8 L% u) H P8 v吸引Cocoa的是这个博客其实是TrustWave公司下属的一个叫Spiderlab团队的官方博客,貌似比较有意思。例如它提到了Honeypot Alert这个标签里的文章都是分析他们一个Web蜜罐的Apache access_log日志的。# i4 ]6 G) }0 c1 J% e
9 y% t) x: X6 z: f简单介绍一下这篇文章吧。
% h6 p, m; i% }4 v! v! V
: c3 Y$ t! H' f: N% S7 l# Q开启WP错误记录功能
( }+ ^# v& A% f. x7 H只需要修改wp-config.php的如下几行:
4 w2 P+ [/ z6 [2 \4 M
8 g: Q9 P( b8 n6 H' Z5 t( Q% u@ini_set('log_errors','On'); @ini_set('display_errors','Off'); @ini_set('error_log','/home/example.com/logs/php_error.log');SQL 注入扫描
1 p2 d% P' C. p# B( J3 Y
, j9 i5 D" [$ o( e3 j- A( W+ ~5 S[07-Dec-2012 02:40:49] WordPress database error You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'WHERE id = -1\'' at line 1 for query SELECT text, author_id, date FROM WHERE id = -1\'6 |$ H9 M2 J# P) `
[07-Dec-2012 02:40:50] WordPress database error You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'WHERE id = 999999.9 UNION ALL SELECT 0x31303235343830303536--' at line 1 for query SELECT text, author_id, date FROM WHERE id = 999999.9 UNION ALL SELECT 0x31303235343830303536--- e, O1 A* h2 w4 ?" m
[07-Dec-2012 02:40:53] WordPress database error You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'WHERE id = 999999.9 UNION ALL SELECT 0x31303235343830303536,0x313032353438303035' at line 1 for query SELECT text, author_id, date FROM WHERE id = 999999.9 UNION ALL SELECT 0x31303235343830303536,0x31303235343830303536--; O5 s8 S5 n( I$ S2 b
上面的日志就是在暴力猜解表的列数,那个巨大的十六进制值会被解析成null。
( r2 P5 C% c, a9 B6 cSQL盲注扫描4 d9 Z! r$ M% {5 O
攻击者使用了类似"waitfor delay"和"benchmark"这样的函数来盲注。5 \8 c' a; v$ H* Z7 s: g
6 Q2 B9 H4 j" {% v9 W: ^; S[07-Dec-2012 02:43:21] WordPress database error You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'WHERE id = -1; if (1=1) waitfor delay \'00:00:05\'--' at line 1 for query SELECT text, author_id, date FROM WHERE id = -1; if (1=1) waitfor delay \'00:00:05\'--
. F8 }" R! n+ V[07-Dec-2012 02:43:27] WordPress database error You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'WHERE id = -1 and if(1=1,BENCHMARK(8623333,MD5(0x41)),0)' at line 1 for query SELECT text, author_id, date FROM WHERE id = -1 and if(1=1,BENCHMARK(8623333,MD5(0x41)),0)( _! a+ R. @2 ^4 l/ N
Google一下大规模扫描
& Y* O) y8 G7 G% t: D& R- O/ |" N+ j9 y8 {8 z( y
/ m! |$ H s% W @8 A ' D8 D- ^8 ]. h8 @; @1 N* v
6 j! a% |5 r- s" T' O# O
' i1 B5 U" i. o" [0 o* `
5 C5 ]" I, F/ c* o( c
僵尸网络控制着可能使用被感染主机来识别潜在的目标。下面是该公司的蜜罐捕获到的一个RFI(远程文件包含)攻击代码里的片段: - sub google() { my @list; my $key = $_[0]; for (my $i=0; $i<=400; $i+=10){ my $search = ("http://www.google.com/search?q=".&key($key)."&num=100&filter=0&start=".$i); my $res = &search_engine_query($search); while ($res =~ m/<a href="\"?http:\/\/([^">\"]*)\//g) { if ($1 !~ /google/){ my $link = $1; my @grep = &links($link); push(@list,@grep); } } } return @list;6 b1 x+ S! Y9 t0 E) d+ {9 o- G
# z5 @" Y: ?2 T2 {& n k$ f5 |Cocoa总结:文章比较简单,但是从日志来检测攻击貌似是目前流行的一个方向。% T7 v" O% J) T+ j: k( W4 j
|
本帖子中包含更多资源
您需要 登录 才可以下载或查看,没有帐号?立即注册
x
|