It appears as though someone is attempting to access http://humano.ya.com via
a redirect.It's is probably not a "real" exploit but a miscrafted URL
referral.Without more information related to the contents of your index.php, I
can't tell you what exactly they are exploiting. However, since the page they
are going to doesn't appear to be a google ad site or phishing site, I would
just call this a mistaken URI fat fingered redirect from some place?But here's
the basic steps for "forensics" of any such problem (even the exploitive
ones):1) Where is it coming from? Your log should have a complete source
IP?Cut and splice the complete log report example into your "forensics"
report.Include your TIMEZONE for their edification. Include the date of the
first attack using grep on your logs. Add frequency or whatever else is unique
about it.If the issue or attack comes from multiple sources, indicating bots,
include that information also.2) Run a whois on the source IP and see who is
the Swip'd IP block owner, domain name, and access that page for additional
information.Cut and splice the technical contact for that block into your
"report".3) Go to the referral site (http://humano.ya.com) and find their email
address to add to the "report".4) Send a copy of the referring ip address to
your firewall administrator to deny for port 80/443, or add to your server
based IPTABLES deny via a one liner:iptables -A INPUT -s $ipaddress -j
DROP/etc/init.d/iptables save5) Include your name and address, contact
information and statement of confidentiality.www.Obnosis.com |
http://en.wiktionary.org/wiki/Citations:obnosis |
http://www.urbandictionary.com/define.php?term=obnosis (503)754-4452Catch the
January PLUG HackFest! Kristy Westphal, CSO for the Arizona Department of
Economic
Security will provide a one hour
presentation on forensics.Date: Wed, 3 Dec 2008 14:39:40 -0800From: [EMAIL
PROTECTED]: OT: Website ExploitsTo: [EMAIL PROTECTED],I am working on a website
that gets a lot of exploit attempts.They mostly look like this:
/index.php?display=http://humano.ya.com/mysons/index.htm?Our code is set to
disregard any value that is not expected. I'm wondering if there is a clearing
house for reporting this type of stuff. I have the IP address as reported....
if that is accurate.Thanks in advance!Keith
_________________________________________________________________
Send e-mail faster without improving your typing skills.
http://windowslive.com/Explore/hotmail?ocid=TXT_TAGLM_WL_hotmail_acq_speed_122008
---------------------------------------------------
PLUG-discuss mailing list - [email protected]
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
