我应该如何监控我的网站的潜在威胁？
通过查看数据库错误日志，我们发现源源不断的几乎成功的 SQL 注入攻击。 一些快速编码可以避免这种情况，但我如何为数据库和 Web 服务器（包括 POST 请求）设置监视器来检查这一点？ 我的意思是，如果有针对脚本小子的现成工具，是否有现成的工具可以提醒您他们突然对您的网站产生随机兴趣？
By looking at our DB's error log, we found that there was a constant stream of almost successful SQL injection attacks. Some quick coding avoided that, but how could I have setup a monitor for both the DB and Web server (including POST requests) to check for this? By this I mean if there are off the shelf tools for script-kiddies, are there off the shelf tools that will alert you to their sudden random interest in your site?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
有趣的是，Scott Hanselman 今天在 UrlScan 上发表了一篇帖子，这是你可以做的一件事帮助监控和最大程度地减少潜在威胁。 这是一本非常有趣的读物。
Funnily enough, Scott Hanselman had a post on UrlScan today which is one thing you could do to help monitor and minimize potential threats. It's a pretty interesting read.
UrlScan 对于 iis6 和 7 来说确实是一个不错的选择； 我还发现： dotDefender 付费，也涵盖 Apache 或 IIS 5-7，我发现了一个 SQL 注入卫生 ISAPI
鉴于最近广泛传播的 SQL 注入尝试，也值得注意禁止 web 应用程序的 db 用户帐户查询系统表（在 MS SQL Server 中是 sysobjects 和 syscolumns）是一个好主意。
我认为这个线程保证为 Apache 和其他 Web 服务器提供更多免费的解决方案。
不幸的是，入侵检测并不是我想要的，所以 sgfree 并不完全是一个网站攻击监视器，除非我不明白它是如何工作的。
UrlScan does seem like a nice option for iis6 and 7; I also found: dotDefender for pay which also covers Apache or IIS 5-7, and I had found an SQL Injection sanitation ISAPI
It is also worth noting in light of a recent wide spread SQL Injection attempt that dissallowing your webapp's db user account from querying the system tables (in MS SQL Server it's sysobjects and syscolumns) is a good idea.
I think this thread warrants more free solutions for Apache and other web servers.
Unfortunately intrusion detection was not what I had in mind, so sgfree isn't exactly a web site attack monitor, unless I'm not understanding how it works.
如果您可以返回并修改您的应用程序代码，我建议将 log4j/log4net 集成到应用程序中。 从那里，您可以编写代码来检查表单字段或 URL（例如，在 .NET 应用程序的 global.asax 级别），并在检测到恶意代码时创建日志条目。
log4j/log4net 的好处是您可以配置电子邮件/寻呼机/SMS 类型附加程序，以便一旦发现恶意尝试，您就会收到通知。
我正在将一些 log4net 代码合并到我们拥有的 CMS 系统中，并且我希望根据不断涌入的 ASPRox 攻击来做到这一点。
If you could go back and modify your app code, I'd suggest getting log4j/log4net integrated into the application. From there you could write code that would check a form field or URL (say at the global.asax level for .NET apps) and make a log entry when malicious code is detected.
The nice thing about log4j/log4net is that you can configure an e-mail/pager/SMS type appender so as soon as the malicious attempt was caught, you would be notified.
I'm in the process of merging some log4net code into our CMS system we have and I'm looking to do just this in light of the influx of ASPRox attacks that have been coming our way.
监控网络和数据库访问日志应该会提醒您类似的事情，但如果您想要一个功能更齐全的警报系统，我会建议某种 IDS/IPS。 不过，您需要一台备用机器和一个可以进行端口镜像的交换机。
如果您有这些，那么 IDS 是一种监视流量以防止多次入侵尝试（将会有很多）的廉价方法。 基于 Snort (www.snort.org) 的 IDS 非常出色，并且有一些免费的完整打包版本可用。 我用过的一个是 StrataGuard (http://sgfree.stillsecure.com/)，它可以配置为 IDS（入侵检测系统）或 IPS（入侵防御系统）。 如果您的流量不超过 5Mbps，则可以免费使用。
如果您确实使用 IDS/IPS，我建议您先让它作为简单的 IDS 运行一个月左右，然后再允许它防止攻击。
这可能有点过分了，但是如果您有一台备用机器，那么让 IDS 被动运行也没什么坏处。
Monitoring web and DB access logs should alert you to things like this, but if you want a more fully featured alert system I would suggest some kind of IDS/IPS. You'll need a spare machine though, and a switch that can do port mirroring.
If you have those then an IDS is a cheap way of monitoring your traffic for many intrusion attempts (there will be lots). Snort (www.snort.org) based IDSes are excellent, and there are some free fully packaged versions available. One I have used is StrataGuard (http://sgfree.stillsecure.com/), and it can be configured as an IDS (Intrusion Detection System) or as an IPS (Intrusion Prevention System). It's free to use if your traffic does not exceed 5Mbps.
If you do go with an IDS/IPS I'd advise you to let it run as a simple IDS for a month or so, before you allow it to prevent attacks.
This may be overkill, but if you have a spare machine lying around it can't hurt to have an IDS running passively.
您可以将系统设置为踢出一些错误消息，然后向系统发出 JSON 或 http 调用，该系统将监视、报告（日志）并发送任何类型的警报，例如短信/电子邮件或电话。
查看developer.alertcaster.com
特别是如果您需要监视多个同时发生的事件（听起来您正在这样做），这可能是一个很好的解决方案。
You can set up your system to kick out some error message that then makes a JSON or http call to a system that will monitor, report (log) and send out any kind of alert such as SMS/email or a phone call.
Check out developer.alertcaster.com
Especially if you need to monitor multiple simultaneous events, which it sounds like you have going on, this might be a good fix.