full-disclosure - Re: Random HTTP-Requests

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 31 Mar 2009 11:56:45 -0300
From: Andres Riancho <andres.riancho@...il.com>
To: "Jan G.B." <ro0ot.w00t@...glemail.com>
Cc: full-disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: Random HTTP-Requests

Jan,

On Tue, Mar 31, 2009 at 11:30 AM, Jan G.B. <ro0ot.w00t@...glemail.com> wrote:
> Hi there,
>
> I've noticed that some weird requests are showing up in the error logs
> of one of my apache webservers.
> The requests seem to have the following in common:
>
> * GET Request on some random alphanumeric string like "GET /hDMe9NS"

w3af [0] uses these types of requests to identify the 404 response of
a web application. Maybe its somebody using w3af to scan your website?
Are you seeing a lot of requests coming from the same IP address after
the "random" request?

> * Referer has some randomized, invalid URL like
> http://www.kSJn32.com/ckJMSC/kSMSR/mndm/sads.html

w3af [0] doesn't perform requests with invalid referers; at least not
in the original version. Someone could have modified it to behave like
this.

> Every domain that showed up wasn't registered - no DNS reply or whatsoever.
>
>
> Here's an example out of my Log file ( I slightly modified the random
> strings - just in case ;))
>
> [Tue Mar 30 10:12:41 2009] [error] [client 124.236.*.*] File does not
> exist: /var/www/foo.bar/web/hFBeX7EK, referer:
> http://www.ruyidqpg.com/SJQubgQP/QenlI/_n2Pn/_px/Uph/wSBf_l/leJB/C8Y00EIPfD07U/AO8lnzhgAl/SD70gA8Jg/nfA013J/ZOWAgYCZ/DOf7hg.html

How does the corresponding entry in the access.log file look like? It
should show you some user agent... To find this just:

grep hFBeX7EK access.log

> The amount of random directories isn't constant.
>
> Any Ideas what is causing these requests? Is it a well known worm?
> What could it be.. what for..?
> The Server is Running Apache with PHP, the main application is made
> with the symfony framework.
>
> Thanks, Regards
>
>
>
> PS: You believe this doesn't belong into this mailing list? Sorry, I'm
> not interested - keep it to yourself.
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>


[0] http://w3af.sf.net/

Cheers,
-- 
Andrés Riancho
http://www.bonsai-sec.com/
http://w3af.sourceforge.net/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/