Where do I find more information about a given hacking attempt requests to my website?

Question

Having a report which shows me to which requests my website responded with a 404, I often find hacking attempts like this:

• Some are recurrent and too explicit, like PHPMyAdmin-type requests exploiting the known vulnerabilities in old versions of PHPMyAdmin.

• Other are new and related to something which happened recently. For example, probably every website received an /index.php?-s request the last days.

• Other, finally, are cryptic to me. What is, for example, /spaw2/spacer.gif I see very frequently (with its variants like /admin/spaw/spacer.gif)? Or /wpad.dat that I've already seen a few times?

Every time I see a (failed) vulnerability exploit in the reports of a website, I want to know more about the vulnerability, since:

• If this variant of the vulnerability exploit failed with a 404, another one may succeed,

• If the vulnerability exploit failed with a 404 on my website, it may succeed on a website of one of my customers who have different configurations and platforms.

Is there a website which maps¹ URIs to vulnerabilities? If not, how to find what is the vulnerability corresponding to an URI, keeping in mind that Google search for this URI is polluted by server logs, usage statistics and other automated reports?

---

^{¹ A such mapping would, of course, have two limitations: being able to map only the patterns and not the whole request when the request contains, inside it, the IP address of the attacker or a zombie, and being irrelevant for proxy requests, i.e. the requests which attempt to see if your website can act as a proxy.}

Answer 1

Having a web server, I often find some of those 404 errors.

Those reflect a bot trying many URLs that, if they don't return a 404 error code, mean the targeted application exists in the server, and an exploit is possible.

If this variant of the vulnerability exploit failed with a 404, another one may succeed,

Keep in mind that while you get 404, it means you don't have the targeted application installed, and your server is not at risk (for this application). It's when the bot will hit a 200 http status code that you will have to worry, since it means the page exists and thus a possible vulnerability is present (it now depends on the version of the application).

Now, I don't know any "Matching url to application", but since the application are usually installed in a directory of their name, say "phpmyadmin" for ... well, PHPMyAdmin, you'll be able to guess that /spaw2/spacer.gif is for the Spaw2 editor.

Now, in order to secure your web server a little bit more, I can recommand you to :

1. Install application in a non logic name. PHPMyAdmin should not be present at /phpmyadmin/. As you can see, bots are also trying /pma/, but you can install it at /p-m-a/ or even something opposite like /kikoo/.
2. For risky application, like ... PHPMyAdmin, I warmly recommend you to limit access to some IP address only, using the .htaccess if you're using Apache, or directly in the configuration of your host for others (like NGinx). If you can't, having it on some other folder (see #1) is a good start.
3. Even if you move or if you don't have the application installed, you'll still have the 404 errors. In order to reduce it, you can add some rules into your firewall, like for /spaw2/spacer.gif. But don't forget them in case some day, you will really have a file named exactly like this!
4. If you use Apache, you can configure Fail2Ban to ban bots that do unusual stuffs, like "too many password failures, seeking for exploits, etc".

Hope this helps!