Logging Apache Request with MySQL Query/SQL Injection Attack

If you add mod_perl to your apache configuration then you can use the request handler http.conf options to call perl code at various points of the request path. One of these handlers could easily log the current request to a file. You might need to play a little with POST requests; I've not tried.

http://search.cpan.org/~pgollucci/mod_p … s/http.pod">http://search.cpan.org/~pgollucci/mod_perl-2.0.3/docs/user/handlers/http.pod

Thanks Stephen thats a great start, I am reading the POD now, but am guessing that mod_perl cannot capture a mysql query performed by PHP, we'll see.

mysql, itself, might be capable of logging all SQL requests (but I'm not a mysql expert so I dunno). The combination of request logs and SQL logs should allow forensics.

Yes you are right in theory, we are logging slow_queries but it's proving a bit difficult to match the requests to the queries.

I'll take that as the best way to do it, thanks again Stephen, for a very quick, and equally informative answer.

UPDATE: Actually though, if we have concurrent instances of apache2 and equal connections to MySQL, I'm thinking the requests to queries combination (permutations) will be quite high (eg. 20 possible apache requests with 20 MySQL queries), without knowing or recording a query identifier, we wouldn't know which one of the concurrent requests caused which one of the concurrent queries, although thinking more, not all requests are started at the same time so it might be ok. I'll try it out.

Why not just turn on the normal mysql logging and/or binlog, then compare timestamps in mysql log and apache log.

I dont have a utility to compare the timestamps, and from looking manually the timestamps don't match, is this way the best way?

I have actually found mod_security might be able to log POSTDATA, so I'm gonna use that aswell, and combine with timestamp matching, probably have to write a perl script to do that, unless there is one already? I cannot see one on google.