Introduction

SQL injection when malicious SQL query executed against database. This guide provides step-by-step diagnosis and resolution.

Symptoms

Typical error output:

bash
WAF Alert: SQL Injection detected
Payload: id=1 UNION SELECT username,password FROM users--
Source IP: 198.51.100.10
Target: /api/users

Common Causes

  1. 1.Vulnerability exploited by external attacker
  2. 2.Credential compromise via phishing or theft
  3. 3.Misconfiguration allowing unauthorized access
  4. 4.Insider threat or negligent behavior

Step-by-Step Fix

Step 1: Check Current State

bash
# Check security logs
grep -r "ALERT\|CRITICAL\|ERROR" /var/log/security/
journalctl -u security-scanner --since "1 hour ago"
# Review SIEM dashboard

Step 2: Identify Root Cause

bash
# Check authentication logs
grep -i "failed\|error" /var/log/auth.log
# Review network connections
netstat -tunap | grep ESTABLISHED
# Check running processes
ps auxf | grep -i suspicious

Step 3: Apply Primary Fix

```bash # Isolate affected system iptables -A INPUT -s <malicious-ip> -j DROP systemctl stop affected-service

# Preserve evidence cp /var/log/auth.log /evidence/auth.log.$(date +%s)

# Reset credentials passwd affected-user # Revoke compromised tokens ```

Step 4: Apply Alternative Fix

bash
# Alternative: Review and remediate
cat /var/log/auth.log | grep -i "failed\|error"
auditctl -l  # List audit rules
lastb | head -20  # Failed login attempts

Step 5: Verify the Fix

bash
# Verify remediation
grep -c "CRITICAL" /var/log/security/
# Should show 0 new critical alerts
systemctl status security-monitor

Common Pitfalls

  • Not isolating systems before investigation
  • Destroying evidence while remediating
  • Using compromised admin accounts for response
  • Not documenting timeline of events

Best Practices

  • Have incident response plan documented
  • Preserve evidence before remediation
  • Communicate with stakeholders promptly
  • Conduct post-incident review
  • Security Incident Response
  • Forensic Investigation
  • System Recovery
  • Security Hardening