Massive SQL injection attack making the rounds—694K URLs so far
1–10 of 22 posts
Re: Massive SQL injection attack making the rounds—694K URLs so far
#2Hmm, "indiscriminate SQL injection attack" seems like a paradoxical concept to me.
Re: Massive SQL injection attack making the rounds—694K URLs so far
#3Any info on what exactly the exploit does and which databases are targeted? I'm impressed that an indiscriminate injection attack is so successful on a wide range of websites.
Re: Massive SQL injection attack making the rounds—694K URLs so far
#4Been watching this sucker for weeks.... it's pretty persistent but pretty dumb - keeps hitting servers that don't actually have any SQL or other backend storage at all... so I just let it hammer away (I figure if it's wasting it's time on me, it's not hurting someone else)
Re: Massive SQL injection attack making the rounds—694K URLs so far
#5Hmm, "indiscriminate SQL injection attack" seems like a paradoxical concept to me.
It's fairly easy to find the low-hanging SQLi vulns on a site automatically, but automatically exploiting them is tough. How do you know where you are in the query, what table/fields to modify/insert into, etc? I'd love to take this apart and figure out how it works.
Re: Massive SQL injection attack making the rounds—694K URLs so far
#6[deleted]
Re: Massive SQL injection attack making the rounds—694K URLs so far
#7I've seen a spike in my error log the past 2 weeks of SQL injection tries on my login/signup pages.
Seems they were going after low hanging fruit based on my logs and the syntax they were using.
Re: Massive SQL injection attack making the rounds—694K URLs so far
#8Any info on what exactly the exploit does and which databases are targeted? I'm impressed that an indiscriminate injection attack is so successful on a wide range of websites.
Exactly. I'd like to know how to check my personal site and some of our sites at work to see if they are vulnerable or not.
Re: Massive SQL injection attack making the rounds—694K URLs so far
#9April fools?
Re: Massive SQL injection attack making the rounds—694K URLs so far
#10Been watching this sucker for weeks.... it's pretty persistent but pretty dumb - keeps hitting servers that don't actually have any SQL or other backend storage at all... so I just let it hammer away (I figure if it's wasting it's time on me, it's not hurting someone else)
how/where are you watching it?