Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've noticed a few requests like this to a Rails application I am maintaining:

GET http://mydomain.com/?f=4&t=252751+++++++++++++++++++++++++++++++++++++++++Result:+%E8%F1%EF%EE%EB%FC%E7%F3%E5%EC+%EF%F0%EE%EA%F1%E8+85.17.122.209:6188;+%ED%E5+%ED%E0%F8%EB%EE%F1%FC+%F4%EE%F0%EC%FB+%E4%EB%FF+%EE%F2%EF%F0%E0%E2%EA%E8;+Result:+GET-%F2%E0%E9%EC%E0%F3%F2%EE%E2+1;+%ED%E5+%ED%E0%F8%EB%EE%F1%FC+%F4%EE%F0%EC%FB+%E4%EB%FF+%EE%F2%EF%F0%E0%E2%EA%E8;

It looks like an attempt to exploit some vulnerability to me, but I can't make sense out of what it's supposed to do, and it's kind of hard to google. Any insights would be appreciated.

share|improve this question

3 Answers 3

up vote 21 down vote accepted

The request parameter is encoded with Windows Codepage 1251 and contains an apparently harmless error message in Russian:

используем прокси 85.17.122.209:6188; не нашлось формы для отправки; Result: GET-таймаутов 1; не нашлось формы для отправки;

Roughly translated to English, the message reads:

using proxy 85.17.122.209:6188; there were no forms to be sent; Result: GET-timeout 1; there were no forms to be sent;

It surely does not look as if someone is trying to hack you. I would rather assume that something is trying to report an error and due to misconfiguration is calling your server instead of whatever is supposed to track or handle the problem.

share|improve this answer
3  
Wow, I love stack exchange. Thanks! –  Thilo Jul 29 '13 at 14:59

It might be that someone is trying to fuzz your website in the hope of finding a vulnerability. It's actually quite normal to see these passing by. It's called internet background noise (well in this case you are running a service, so the description isn't entirely correct).

I ran this through a URL decoder:

?????????? ?????? 85.17.122.209:6188; ?? ??????? ????? ??? ????????; Result: GET-????????? 1; ?? ??????? ????? ??? ????????

I'm not entirely sure what he is trying to achieve (could this be your IP?) but it might be that he's hoping to find a SQL injection which allows escalation to command injection. I also suspect that they are using a different character encoding for some of the fields in the hope your code will directly pass it to your database backend (this is called multi byte exploit SQL injection, have a look here Multibyte character exploits - PHP/MySQL ). I haven't been able to identify the character encoding used though.

I've had them as well on my websites, generally I'm not too worried about them (you just need to keep track of all security updates). I'd advise you to get a Host Based Intrusion Detection system. My favorite on is called OSSEC and will (sometimes after a bit of finetuning) will automatically block these offenders. It's also nice to note that it incorporates a rootkit hunter so that if they breached you, it will start notifying file changes (it also triggers when you perform updates or edit critical files, so it's for those situations where you are sure you weren't doing anything).

share|improve this answer

I think an attacker checked is there any xss or sql injections exist in your application .If your properly sanitize your user inputs through the get parameters , you dont need to worry about these kind of cases .

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.