sqli Free

SQL-injection payloads worked through in the query string — an attack on the databases behind the sites; one and out

Category

web

Threshold

3/10m

Ban policy

exploit

Report

sqli

Parsers

http-sqli-probe

Why it is written this way

The rule file View raw

# SQL-injection probing: eleven DISTINCT injected query strings inside
# fifteen seconds. Distinct is what keeps it honest — a broken page
# resending the same odd query counts once. CrowdSec's own figure
# (capacity 10, leakspeed 1s, distinct args), run on shared hosting
# without a false positive.
rule: sqli
description: "SQL-injection payloads worked through in the query string — an attack on the databases behind the sites; one and out"
about:
  purpose: >-
    Ban whoever is working through SQL-injection payloads against your pages.
  blocks: >-
    Three DISTINCT injected query strings in ten minutes. Distinct is what keeps it honest — a broken page resending the same odd query counts once.
  applies_to: >-
    Any web server. Run against shared hosting without a false positive at CrowdSec's own figures.
  requires:
    - >-
      The site's access log in combined format, declared as `log: http`.
  beware:
    - >-
      A site whose own links carry SQL-looking query strings would feed this rule. Read a day in detect-only before arming it if your application is unusual.
category: web
parsers: http-sqli-probe
threshold: 3/10m
distinct: query
ban: exploit
report: sqli