Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was going through the logs of my application hosted on IIS 7.5.

I found a request like the following:

2013-08-19 08:14:10 192.168.200... HEAD //DSL/ - 80 - 115.114.27... 
DirBuster-0.12+(http://www.owasp.org/index.php/Category:OWASP_DirBuster_Project) 404 6 0 62

Is this some kind of attack? I have searched google for DirBuster and found the following

DirBuster is a multi threaded java application designed to brute force directories and files names on web/application servers. Often is the case now of what looks like a web server in a state of default installation is actually not, and has pages and applications hidden within. DirBuster attempts to find these.

(Source: http://www.owasp.org/index.php/Category:OWASP_DirBuster_Project)

Should I be worried about this?

share|improve this question
add comment

migrated from stackoverflow.com Aug 29 '13 at 16:38

This question came from our site for professional and enthusiast programmers.

2 Answers

This log entry means that someone, somewhere, tries to know the names of the directories on your server by the simple but inelegant expedient of trying a lot of possible names -- and that someone is honest enough to let his tool state it plainly.

Such attacks are very common. Whenever there is a public-facing server on the Internet, seemingly random attacks are to be expected. Most of them are from automated botnets who just try to replicate; they try random IP addresses or server names and then look for "known holes".

There is no reason to worry about DirBuster unless you have on your server a directory which is accessible from unauthenticated users, and yet you would prefer that directory to remain "hidden", and the directory name is guessable (i.e. it is something like "secret" instead of "7o8AW4dslEwrSD78C9xaUdns5"). I would argue that if this is your case, then you have reason to worry: not because of DirBuster, but because you are doing your security wrong and should go back to design phase, this time with an architect who has a clue about security.

share|improve this answer
add comment

From my experience, DirBuster tends to be used more often by a real human attacker instead of a bot scanning everything it could find. 100% automated scanning typically only looks for a handful of directory names to exploit specific vulnerabilities, while DirBuster is usually used to try and bruteforce from a large dictionary.

So, this could indicate that an attacker has specifically singled out your site. The attacker may or may not be dedicated, and they may or may not be particularly intelligent.

I am unsure if you're saying that there are a lot of logs like that, or if you only noticed the one request. If there's only one request, then it's just looking for that one directory, in which case it's almost certainly a completely automated attack. If you see more than a few requests with that user-agent, continue reading.

What you should first do is research the IP address and determine if it's a proxy of some kind (HTTP proxy, VPN, Tor exit node), or if it seems to be a residential IP. Then, grep your access logs for that IP for the past week or so and see if it's made any prior visits, or visits after this scan. If it's a fairly generic proxy, past visits from that IP may not be from the same entity, so keep that in mind.

And most importantly of all, do a quick audit of everything in your webroot directory (typically /var/www or /var/www/html on Linux distributions, no idea for IIS). Disable directory indexing, and look for anything sensitive in there you may have forgotten about, like a backup .tar or .sql file containing source code or a database dump.

If the only things accessible to the public are the actual applications you want users to use, then there is really nothing to be concerned with here. Other than that, the only remaining concern is if the attacker appears to be a real human, and if so, if they performed any other actions in an attempt to breach your server.

share|improve this answer
    
Thanks for your response. :) –  Shekhar Aug 30 '13 at 4:21
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.