Having a report which shows me to which requests my website responded with a 404, I often find hacking attempts like this:
Some are recurrent and too explicit, like PHPMyAdmin-type requests exploiting the known vulnerabilities in old versions of PHPMyAdmin.
Other are new and related to something which happened recently. For example, probably every website received an
/index.php?-srequest the last days.
Other, finally, are cryptic to me. What is, for example,
/spaw2/spacer.gifI see very frequently (with its variants like
/wpad.datthat I've already seen a few times?
Every time I see a (failed) vulnerability exploit in the reports of a website, I want to know more about the vulnerability, since:
If this variant of the vulnerability exploit failed with a 404, another one may succeed,
If the vulnerability exploit failed with a 404 on my website, it may succeed on a website of one of my customers who have different configurations and platforms.
Is there a website which maps¹ URIs to vulnerabilities? If not, how to find what is the vulnerability corresponding to an URI, keeping in mind that Google search for this URI is polluted by server logs, usage statistics and other automated reports?
¹ A such mapping would, of course, have two limitations: being able to map only the patterns and not the whole request when the request contains, inside it, the IP address of the attacker or a zombie, and being irrelevant for proxy requests, i.e. the requests which attempt to see if your website can act as a proxy.