0

Actually we have a webfirewall (modsecurity) blocking common sql injections on our server.

I want to know if there is a way to punish users when they try sql injections on the server, by making webfirewall to wait 2 seconds before the answer, there is some way for doing this.

Improve this question
4
  • 3
    wouldn't it make more sense to block their IP and alert the police?
    – Neil McGuigan
    Oct 20 '16 at 17:45
  • 2
    Dont get me bad. I am imagining me calling the brazilian police and sayin something like webfirewall blocked a IP (he probably will say FIREWALL!! Are you a hacker?), and even worst saying the guy is from China or Indonesia... The only that can help is the federals, but i will call they only in the last case! I cant block ips everytime, i need to know what is happen first, if is a real trying because our rules are very hard and i am not behind the server in all the time. I just want to block, and delay every sql injection.
    – Luciano Andress Martini
    Oct 20 '16 at 17:58
  • Injection attack? Block the address. At least for 24 hours. This is one where you really don't want to be nice.
    – roaima
    Oct 20 '16 at 21:32
  • They will just change it address if i simply do that.
    – Luciano Andress Martini
    Oct 21 '16 at 11:43
2

You could use fail2ban for that! Fail2ban is a program that scans logfiles for certain events and then adds firewall rules according to those events.

http://www.fail2ban.org/wiki/index.php/HOWTO_fail2ban_with_ModSecurity2.5

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.