Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We recently got hacked and after cleaning the virus from our machine we pushed out site to go through cloudflare. Although I've noticed scanning attempts on the site have dropped we do for some reason get hundreds of 404s to oursite.com/undefined or oursite.com/like

When there is a 404 i get an email with browser type/ip address/cookie information etc and it's always different, except that the IPs are on the same subnet or the same.

Any ideas as to what they are trying to accomplish. I've for now created a physical directory called undefined, but still a little worried

share|improve this question
2  
Are the IPs from cloudflare or direct connections? With "undefined", it makes me think you might have some JS error that's causing an attempt to load a resource. –  David Mar 24 '13 at 4:39
    
Not Sure if they are from cloudflare, when i do a lookup i just get a country (eg 108.162.249.118). I thought JS initially, but then i get the same hits on /like –  Alessandro Mar 24 '13 at 5:13
    
Check your logs, if those IP addresses are requesting most/all of your pages very quickly, then they're most likely some crawlers for a search engine or a mirroring site. In that case, you have nothing to worry about. If you don't like them, block their subnet. –  Adnan Mar 24 '13 at 8:09
1  
Run "whois 108.162.249.118", you'll see it's a cloudflare IP. Maybe you have some sort of social media thing looking for a URL at /like? –  David Mar 24 '13 at 16:14
    
I just did a test to see if my application recognises my IP and it seems its just picks up cloudflare IPs. The only social media thing we have is the Facebook like boxes that we copied from Facebook. –  Alessandro Mar 24 '13 at 22:28

1 Answer 1

Attackers need to identify what applications are hosted on your domain. They can identify them by scanning for common files and directory structures on your platform. For example, if you run Wordpress, an attacker can look for /wp-admin, and if it returns a 200, they know you are running Wordpress.

Once they know what framework or application you are running, they will start to navigate through known vulnerabilities, or even a 0day, until they are able to compromise your platform.

Now, keep that in mind because CloudFlare simply serves as a ReverseProxy to help protect you. This means, that the incoming requests to your server will be sourced from CloudFlare, not the attacker.

Think of it this way:

[Attacker] -----> [  YourSite  ]
                  [ CloudFlare ]   ----->    [Your Server Request]
                  [ CloudFlare ]   <-----    [Your Server Response]
[Attacker] <----  [  YourSite  ]

CloudFlare looks like your physical server to the attackers. They perform queries, gets, posts, etc to your domain. CloudFlare receives the request first, and then performs some inspection on the request and forwards it to your physical server.

So when you see the requests coming in from CloudFlare, it's because they are serving as a reverse proxy. The /like and /undefined could still be an attacker trying to identify known vulnerabilities on your site.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.