Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We've been logging GET requests on our domain to the following:

XX/YY/ZZ/CI/MGPGHGPGPFGHCDPFGGHGFHBGCHEGPFHHGG

This has no meaning on our site. A search on the web revealed no information, but a few other places which logged similar requests.

Is this a known kind of attack? What might it be targeting?

share|improve this question
add comment

1 Answer

up vote 18 down vote accepted

This is a malicious request, but it's not trying to exploit a vulnerability. It's trying to generate a 404 page, in order to determine what kind of web server or CMS you're running, by identifying tokens in the page source. Error pages often specify their CMS name and version, or the web server name and version, so it's an easy target for recon.

Best advice I can give you is to keep everything patched, and make sure your firewall rules are properly configured. Primary targets are likely to be your CMS and web server, but your OS is important to patch too.

If you've got a few IPs that constantly do it, and you're certain they're not valid customers, feel free to block them for a few weeks to see if they remain persistent.

share|improve this answer
1  
I completely agree with @Polynomial, classic random-generated garbage. Check your error pages to see what information you may be leaking about your setup like OS, versions, etc. The more an attacker can learn the easier it is to exploit your system, so make sure your error pages give as little information as possible –  GdD Sep 19 '12 at 8:03
    
@GdD Interestingly, it's not random. You can find a few instances on Google. The last part looks like keyboard hammering (notice the proximity of the letters on a qwerty keyboard) so I guess it's a hard-coded value designed to always generate a 404. –  Polynomial Sep 19 '12 at 8:41
    
that's pretty much what I meant, randomly (okay pseudo-random 2am basement two-fingered keyboard hammering) generated during coding. –  GdD Sep 19 '12 at 9:23
1  
I'd also recommend installing mod_security and the OWASP Core Ruleset if you're on Apache. If it doesn't block this bot already it probably soon will. This will mean that if you ever do slip up and leave a gap between a patch being available and you installing it, they still won't get the 404 page to identify that you're vulnerable, they'll get a 403 instead. The Core Ruleset may also block the bot that exploits the vulnerabilities in addition to the recon bot. –  Ladadadada Sep 19 '12 at 12:27
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.