My web logs show quite a few sites are now appending the below string to GET query requests that take parameters, the string below has been appended to quite a few requests to my website by multiple ip-addresses.
or (1,2)=(select*from(select name_const(CHAR(111,108,111,108,111,115,104,101,114),1),name_const(CHAR(111,108,111,108,111,115,104,101,114),1))a) -- and 1=1'
Below are two addresses that were overzealous in doing so and were causing enough log activity for me to take action to block them to make my logs readable again.
[root@vosprey2 tmp]# nslookup 184.168.192.72 72.192.168.184.in-addr.arpa name = p3nlwpweb050.shr.prod.phx3.secureserver.net. root@vosprey2 tmp]# nslookup 95.154.220.205 205.220.154.95.in-addr.arpa name = server.ambinet.net.
Just shows hackers are still randomly target any internet facing site, even personal ones.
