0

Actually we have a webfirewall (modsecurity) blocking common sql injections on our server.

I want to know if there is a way to punish users when they try sql injections on the server, by making webfirewall to wait 2 seconds before the answer, there is some way for doing this.

4
  • 3
    wouldn't it make more sense to block their IP and alert the police? Oct 20, 2016 at 17:45
  • 2
    Dont get me bad. I am imagining me calling the brazilian police and sayin something like webfirewall blocked a IP (he probably will say FIREWALL!! Are you a hacker?), and even worst saying the guy is from China or Indonesia... The only that can help is the federals, but i will call they only in the last case! I cant block ips everytime, i need to know what is happen first, if is a real trying because our rules are very hard and i am not behind the server in all the time. I just want to block, and delay every sql injection. Oct 20, 2016 at 17:58
  • Injection attack? Block the address. At least for 24 hours. This is one where you really don't want to be nice. Oct 20, 2016 at 21:32
  • They will just change it address if i simply do that. Oct 21, 2016 at 11:43

1 Answer 1

2

You could use fail2ban for that! Fail2ban is a program that scans logfiles for certain events and then adds firewall rules according to those events.

http://www.fail2ban.org/wiki/index.php/HOWTO_fail2ban_with_ModSecurity2.5

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .