0

For the last few days my logs have been revealing an attack on my system. I don't know what they are trying to accomplish? They seem to be attacking my style sheets only with GETS and POSTS to them.

the queries they are running are variations of this. ' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL# %' ORDER BY 9978# %' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#

Should I be concerned? what are they trying to access? How can I stop them from accessing whatever they are looking for? (I have prepared statements, so I am not too worried, but still just want to know so I can build the best defense possible.) Thank you in advance

LOG file

GET /styles.css?ts=1642369117%27%20ORDER%20BY%201%23 HTTP/1.0
GET /styles.css?ts=1642369117%27%20ORDER%20BY%201%23 HTTP/1.1
GET /styles.css?ts=1642369117%27%20ORDER%20BY%208912%23 HTTP/1.0
GET /styles.css?ts=1642369117%27%20ORDER%20BY%208912%23 HTTP/1.1
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%23 HTTP/1.0
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%23 HTTP/1.1
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%23 HTTP/1.0
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%23 HTTP/1.0
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%23 HTTP/1.1
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%23 HTTP/1.1
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.0
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.1
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.0
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.1
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.0
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.1
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.0
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.1
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.0
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.0
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.1
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.1
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.0
GET /styles.css?ts=1642369117%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.1
GET /styles.css?ts=1642369117%25%27%20ORDER%20BY%201%23 HTTP/1.0
GET /styles.css?ts=1642369117%25%27%20ORDER%20BY%201%23 HTTP/1.1
GET /styles.css?ts=1642369117%25%27%20ORDER%20BY%209978%23 HTTP/1.0
GET /styles.css?ts=1642369117%25%27%20ORDER%20BY%209978%23 HTTP/1.1
GET /styles.css?ts=1642369117%25%27%20UNION%20ALL%20SELECT%20NULL%23 HTTP/1.0
GET /styles.css?ts=1642369117%25%27%20UNION%20ALL%20SELECT%20NULL%23 HTTP/1.1
GET /styles.css?ts=1642369117%25%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%23 HTTP/1.0
GET /styles.css?ts=1642369117%25%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%23 HTTP/1.1
GET /styles.css?ts=1642369117%25%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%23 HTTP/1.0
GET /styles.css?ts=1642369117%25%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.0
GET /styles.css?ts=1642369117%25%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%23 HTTP/1.1
GET /styles.css?ts=1642369117%25%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.1
GET /styles.css?ts=1642369117%25%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.0
GET /styles.css?ts=1642369117%25%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.1
GET /styles.css?ts=1642369117%25%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.0
GET /styles.css?ts=1642369117%25%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.0
GET /styles.css?ts=1642369117%25%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.1
GET /styles.css?ts=1642369117%25%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.1
GET /styles.css?ts=1642369117%25%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23 HTTP/1.0
James
  • 196
  • 14
  • 1
    Probably just a bot doing mass penetration testing on a ton of random sites to see if any give a response. I set up a small web site once and not long after it began getting a periodic sweep for a ton of random potential vulnerabilities. Just make sure you stay up to date on updates and you are probably fine so long as you don't actually attempt to process any of those SQL requests. – Locke Mar 26 '22 at 09:27
  • 1
    As long as all client side parameters get treated properly you should be okay. That said, they’re still trying to do harm to you and you should do things like ip blocking to put a stop to it. It must be noted that the Russian invasion of Ukraine has correlated with an increase of hacking attempts in all fields – Andrew Sayer Mar 26 '22 at 10:25
  • Thank you Locke and Andrew, much obliged. Just a little worried about the frequency that has increased dramatically over the last few days (which I also blame the Russians, rightly or wrong). To Add, yes I block on the firewall, just as add a precaution. Also, I know I am not smarter than the average hacker, so just wondering what is the best possible defence I can muster – James Mar 26 '22 at 11:00

0 Answers0