Got this email, what is he doing?

Regular Joined: Aug 04, 2006 Posts: 64

i added those strings but before i get it setup i got this email

User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
Query String: www.eqcaelum.com/index.php?;DECLARE_@S_CHAR(4000);SET_@S=CASThttp://www.yahoo.com/
Get String: www.eqcaelum.com/index.php?;DECLARE_@S_CHAR(4000);SET_@S=CASThttp://www.yahoo.com/
Post String: www.eqcaelum.com/index.php
Forwarded For: none
Client IP: none
Remote Address: 74.195.190.116
Remote Port: 63527
Request Method: GET

Posted: Thu Aug 28, 2008 12:27 am

The previous post by Gremmie should protect against this string as well.

registered · Posted: Thu Aug 28, 2008 7:15 am

lonk, that just looks like a malformed attack. My .htaccess fix won't stop that because there are no spaces between DECLARE and the @, however if that is the actual text you got from Sentinel that probe can't possibly do anything. It doesn't look syntactically correct in any SQL I am aware of.

Posted: Thu Aug 28, 2008 9:02 am

Unfortunately I cannot provide the script any longer simply because since the htaccess edit I haven't received ANY scripts (hundreds) that made it through. But I do remember that there were no underscores in the script. Perhaps this is a deliberate attempt to bypass any type of script spoiler, who knows.

Cheers

Posted: Thu Aug 28, 2008 10:42 am

I stand corrected, sorry. Embarassed