<p>By looking at our <code>DB's</code> error log, we found that there was a constant stream of almost successful SQL injection attacks. Some quick coding avoided that, but how could I have setup a monitor for both the DB and Web server (including POST requests) to check for this?  By this I mean if there are off the shelf tools for script-kiddies, are there off the shelf tools that will alert you to their sudden random interest in your site?</p>

[{'answer_id': 8515, 'author': 'lomaxx', 'author_id': 493, 'author_profile': 'https://Stackoverflow.com/users/493', 'pm_score': 4, 'selected': True, 'text': '<p>Funnily enough, Scott Hanselman had a <a href="http://www.hanselman.com/blog/HackedAndIDidntLikeItURLScanIsStepZero.aspx" rel="nofollow noreferrer">post on UrlScan</a> today which is one thing you could do to help monitor and minimize potential threats. It\'s a pretty interesting read.</p>\n'}, {'answer_id': 8835, 'author': "Shane O'Grady", 'author_id': 1115, 'author_profile': 'https://Stackoverflow.com/users/1115', 'pm_score': 0, 'selected': False, 'text': '<p>Monitoring web and DB access logs should alert you to things like this, but if you want a more fully featured alert system I would suggest some kind of IDS/IPS. You\'ll need a spare machine  though, and a switch that can do port mirroring.\nIf you have those then an IDS is a cheap way of monitoring your traffic for many intrusion attempts (there will be lots). Snort (www.snort.org) based IDSes are excellent, and there are some free fully packaged versions available. One I have used is StrataGuard (<a href="http://sgfree.stillsecure.com/" rel="nofollow noreferrer">http://sgfree.stillsecure.com/</a>), and it can be configured as an IDS (Intrusion Detection System) or as an IPS (Intrusion Prevention System). It\'s free to use if your traffic does not exceed 5Mbps.\nIf you do go with an IDS/IPS I\'d advise you to let it run as a simple IDS for a month or so, before you allow it to prevent attacks. </p>\n\n<p>This may be overkill, but if you have a spare machine lying around it can\'t hurt to have an IDS running passively.</p>\n'}, {'answer_id': 11717, 'author': 'dlamblin', 'author_id': 459, 'author_profile': 'https://Stackoverflow.com/users/459', 'pm_score': 2, 'selected': False, 'text': '<p><a href="http://learn.iis.net/page.aspx/473/using-urlscan" rel="nofollow noreferrer">UrlScan</a> does seem like a nice option for iis6 and 7; I also found: <a href="http://www.applicure.com/?page=dotDefender" rel="nofollow noreferrer">dotDefender</a> for pay which also covers Apache or IIS 5-7, and I had found an <a href="http://www.codeplex.com/IIS6SQLInjection" rel="nofollow noreferrer">SQL Injection sanitation ISAPI</a></p>\n\n<p>It is also worth noting in light of a recent wide spread SQL Injection attempt that dissallowing your webapp\'s db user account from querying the system tables (in MS SQL Server it\'s sysobjects and syscolumns) is a good idea.</p>\n\n<p>I think this thread warrants more free solutions for Apache and other web servers.</p>\n\n<p>Unfortunately intrusion detection was not what I had in mind, so sgfree isn\'t exactly a web site attack monitor, unless I\'m not understanding how it works.</p>\n'}, {'answer_id': 11725, 'author': 'Dillie-O', 'author_id': 71, 'author_profile': 'https://Stackoverflow.com/users/71', 'pm_score': 2, 'selected': False, 'text': "<p>If you could go back and modify your app code, I'd suggest getting log4j/log4net integrated into the application. From there you could write code that would check a form field or URL (say at the global.asax level for .NET apps) and make a log entry when malicious code is detected.</p>\n\n<p>The nice thing about log4j/log4net is that you can configure an e-mail/pager/SMS type appender so as soon as the malicious attempt was caught, you would be notified.</p>\n\n<p>I'm in the process of merging some log4net code into our CMS system we have and I'm looking to do just this in light of the influx of ASPRox attacks that have been coming our way.</p>\n"}, {'answer_id': 19125418, 'author': 'Brian', 'author_id': 2836401, 'author_profile': 'https://Stackoverflow.com/users/2836401', 'pm_score': 0, 'selected': False, 'text': '<p>You can set up your system to kick out some error message that then makes a JSON or http call to a system that will monitor, report (log) and send out any kind of alert such as SMS/email or a phone call.  </p>\n\n<p>Check out developer.alertcaster.com</p>\n\n<p>Especially if you need to monitor multiple simultaneous events, which it sounds like you have going on, this might be a good fix.</p>\n'}]
['https://Stackoverflow.com/questions/8508', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/459/']