Hi Andres, thanks for your Ideas. 2009/3/31 Andres Riancho <[email protected]>: > Jan, > > On Tue, Mar 31, 2009 at 11:30 AM, Jan G.B. <[email protected]> wrote: >> Hi there, >> >> I've noticed that some weird requests are showing up in the error logs >> of one of my apache webservers. >> The requests seem to have the following in common: >> >> * GET Request on some random alphanumeric string like "GET /hDMe9NS" > > w3af [0] uses these types of requests to identify the 404 response of > a web application. Maybe its somebody using w3af to scan your website? > Are you seeing a lot of requests coming from the same IP address after > the "random" request?
nope, at least not always: Looking up the corresponding request in the access log was a good idea.. Here's one example: 221.204.*.* - - [30/Mar/2009:10:21:30 +0200] "GET /mtERuE0/osOAJo/3dK/tUekE2Ws.gif HTTP/1.1" 404 293 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" and another one (with referer) 124.236.*.* - - [31/Mar/2009:17:01:59 +0200] "GET /XePDcSx/BabcSF/4GabcNO0/ncabc/abcf/Babcf-XS/abc/abcFEl/gSabcUs-z/UlabcbF/gib_.gif HTTP/1.1" 404 362 "http://www.labcdl.com/B2abcBfV-j/zabcZ/33z/NBxab2H6/Bvgzabc/NEabc/20Xab4/lxJabc4x/HnabcE/BabcZU/ezBf/nnx/xUBabcX/0S4Z-SnzG.html"; "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" Grepping these IPs in access log shows up www:/var/log/apache2# grep "124.236.*.*" access.log|wc -l 12 www:/var/log/apache2# grep "221.204.*.*" access.log|wc -l 1 All these requests are totally random and ending in with .gif. UA is always the evil IE6. What sane developer would use such a UA? ;) > >> * Referer has some randomized, invalid URL like >> http://www.kSJn32.com/ckJMSC/kSMSR/mndm/sads.html > > w3af [0] doesn't perform requests with invalid referers; at least not > in the original version. Someone could have modified it to behave like > this. > Why would someone want to do this? It makes no sense for me. >> Every domain that showed up wasn't registered - no DNS reply or whatsoever. >> >> >> Here's an example out of my Log file ( I slightly modified the random >> strings - just in case ;)) >> >> [Tue Mar 30 10:12:41 2009] [error] [client 124.236.*.*] File does not >> exist: /var/www/foo.bar/web/hFBeX7EK, referer: >> http://www.ruyidqpg.com/SJQubgQP/QenlI/_n2Pn/_px/Uph/wSBf_l/leJB/C8Y00EIPfD07U/AO8lnzhgAl/SD70gA8Jg/nfA013J/ZOWAgYCZ/DOf7hg.html > > How does the corresponding entry in the access.log file look like? It > should show you some user agent... To find this just: > > grep hFBeX7EK access.log > >> The amount of random directories isn't constant. >> >> Any Ideas what is causing these requests? Is it a well known worm? >> What could it be.. what for..? >> The Server is Running Apache with PHP, the main application is made >> with the symfony framework. >> >> Thanks, Regards >> >> >> >> PS: You believe this doesn't belong into this mailing list? Sorry, I'm >> not interested - keep it to yourself. >> >> _______________________________________________ >> Full-Disclosure - We believe in it. >> Charter: http://lists.grok.org.uk/full-disclosure-charter.html >> Hosted and sponsored by Secunia - http://secunia.com/ >> > > > [0] http://w3af.sf.net/ > > Cheers, > -- > Andrés Riancho > http://www.bonsai-sec.com/ > http://w3af.sourceforge.net/ > _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
