Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a PHP-included form that tells me the URL the customer was visiting when they fill it out. The content of the message was either jibberish or poorly handled by the form. (it looked mostly like this: Утром ÑÐ...) The URL that was reported was URL encoded, I had to decode it twice and this is the (anonymized version of the) result:

http://www.example.com/?param1=value1 [PLM=0] GET http:///?param1=value1 [0,9536,24405] -> [N] POST http://www.example.com//?param1=value1 [PLM=0] GET http://www.example.com/?param1=value1 [0,9536,24405] -> [N] POST http://www.example.com/?param1=value1 [0,0,25521]   0 

I have tried searching Google, but all I find are others asking basically the same thing going back to 2008. What is this?

share|improve this question

closed as off-topic by Rook, Xander, Iszi, Adnan, TildalWave Nov 5 '13 at 17:54

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

1  
I don't see value1 ever being used in an attack, perhaps these are overly anonimized? I don't see enough information here to answer your question. –  Rook Nov 5 '13 at 16:33
    
That was part of what I anonymized. The part of the URL that looks like legitimate addresses would have been valid at our site. The things in square brackets and the litteral GET and POST are what I find strange. (plus the fact that the otherwise legitimate pieces are repeated.) –  TecBrat Nov 5 '13 at 16:54
    
this question is currently unanswerable. The contents of the url they are trying to load maybe a key information. Voting to close. –  Rook Nov 5 '13 at 17:00

1 Answer 1

It looks like the attacker is trying to get your page to spit out some information, such as the full path of your webserver.

For example, if you start using multibyte data in most functions (in PHP at least) which don't start with mb_* then it will throw an error, something along the lines of:

Function does not accept Mutlibyte characters in "/var/www/site/script.php" on line 132

Which then gives the attacker a lot more information about your server, which you don't want them to know.

You can mitigate this by turning error reporting off, or have your own error capturing mechanism.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.