Spiderbot question!

[Rafa]

Hi!

I have server running in the Internet, there is php-program which is used by a little company. I have made .htaccess files to public_html and the php-program folder. Also I have robots.txt to ignore bots.

In php-program folder I have .htaccess file which looks like:

IndexIgnore *
<Limit GET POST>
order deny,allow
deny from all
allow from company-IP
</Limit>
<Limit PUT DELETE>
order deny,allow
deny from all
</Limit>
AuthName website domain

I also have in php-program folder a login file, where company log in to php-program. It is based to mysql databases, and it is protected md5 and mysql username and password is 10 characters mixed by symbols, numbers and upper/lower fonts.

One spamming spider bot is visiting directly in my php-program folder. And error messages what I get looks like:

/php-program/msgbook.php
Http Code: 404Date: Jun 09 07:29:35Http Version: HTTP/1.0Size in Bytes: -
Referer: -
Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

or another

/php-program/removemsg.php?id=32
Http Code: 404Date: Jun 09 07:25:35Http Version: HTTP/1.0Size in Bytes: -
Referer: -
Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

About an hour ago my client did visit those same paths and remove that message which id is 32. I dont know how that bot get those same paths.

That bot get 404 error message, but is he able to hack my mysql databases or read my information another way and is this secure allthought?

Thank you!

(sry for bad english)

[edited by: Rafa at 6:50 am (utc) on June 9, 2009]

[tangor]

Have you checked the security of your mySQL queries? Query injection attacks is the most common assault out there. Sanitize all your forms/inputs to avoid this, and do a little back end examination of strings as well!

[Rafa]

Hmm..Doesn´t that mySQL username and password protect those kind of attacks? I include my databaseconnection from different folders to those php-files.

[Pfui]

By way of an aside/FYI because I saw this for the first time yesterday, from two different hosts... There's an odd SQL injection out there using the UA "NV32ts" that may be related to Conficker.

From the "Frequency X" blog, June 8, 2009:

"The SQL statement involved is typically associated with the user-agent string “NV32ts” often referred to as the NV32ts botnet. ...

"It appears that the attackers are simply performing reconnaissance on the web/sql database for possible direct targeted attacks.

"Is Conficker being used to perform SQL injection attacks or distribute the NV32ts bot? ..."

Conficker SQL Injection connection or coincidence? [blogs.iss.net]

[Rafa]

I try to prevent those injection attacks by using pdo bindparam sentences in mySQL. Shouldn´t that be enough?