What is this hacker trying to do?

问题:

If you do a search for:

http://www.google.co.uk/search?q=0x57414954464F522044454C4159202730303A30303A313527&hl=en&start=30&sa=N

you will see a lot of examples of an attempted hack along the lines of:

1) declare @q varchar(8000) select @q = 0x57414954464F522044454C4159202730303A30303A313527 exec(@q) --

What is exactly is it trying to do? Which db is it trying to work on? Do you know of any advisories about this?

回答1:

He is testing your server for SQL Injection, specifically this is a robust test that will work even if its Blind SQL Injection. Blind SQL Injection is when an attacker is able to execute SQL however, there isn't a viewable response. If the http request takes at least 15 seconds the attacker will know that he can execute SQL, and that your running MS-SQL. After this attack he will follow it up with a xp_cmpdshell() to infect your server.

回答2:

According to http://bytes.com/topic/mysql/answers/888849-hacker-attempt it looks like it's trying to run:

WAITFOR DELAY '00:00:15'

As others have pointed out it's not a DOS attack (as I originally stated) but merely a way to easily determine if the SQL Server is vulnerable and can be added to a list of hosts to perhaps further hack away at later on.

回答3:

In simpler terms he/she/it is very slick. Using the "WAITFOR DELAY..." strategy allows he/she/it to see if the server is vulnerable without logging anything. The check is being done to see what access the connectionstring user has in the db. And like @Rook said, thT WOULD LEAD TO XP_CMDSHELL() which can give the intruder access to the server and even your network.

回答4:

That is a hex string. When you translate it, it translates into: "WAITFOR DELAY '00:00:15'"