13

This morning I checked our nginx logs. 

46.x.x.90 - - [17/Jul/2017:05:51:31 +0000]  "HEAD http://x.x.71.1:80/PMA2011/ HTTP/1.1" 301 0 "-" "Mozilla/5.0 Jorgee" "-"
46.x.x.90 - - [17/Jul/2017:05:51:31 +0000]  "HEAD http://x.x.71.1:80/PMA2012/ HTTP/1.1" 301 0 "-" "Mozilla/5.0 Jorgee" "-"
46.x.x.90 - - [17/Jul/2017:05:51:31 +0000]  "HEAD http://x.x.71.1:80/PMA2013/ HTTP/1.1" 301 0 "-" "Mozilla/5.0 Jorgee" "-"
46.x.x.90 - - [17/Jul/2017:05:51:32 +0000]  "HEAD http://x.x.71.1:80/PMA2014/ HTTP/1.1" 301 0 "-" "Mozilla/5.0 Jorgee" "-"
46.x.x.90 - - [17/Jul/2017:05:51:32 +0000]  "HEAD http://x.x.71.1:80/PMA2015/ HTTP/1.1" 301 0 "-" "Mozilla/5.0 Jorgee" "-"
46.x.x.90 - - [17/Jul/2017:05:51:32 +0000]  "HEAD http://x.x.71.1:80/PMA2016/ HTTP/1.1" 301 0 "-" "Mozilla/5.0 Jorgee" "-"
46.x.x.90 - - [17/Jul/2017:05:51:32 +0000]  "HEAD http://x.x.71.1:80/PMA2017/ HTTP/1.1" 301 0 "-" "Mozilla/5.0 Jorgee" "-"
46.x.x.90 - - [17/Jul/2017:05:51:32 +0000]  "HEAD http://x.x.71.1:80/PMA2018/ HTTP/1.1" 301 0 "-" "Mozilla/5.0 Jorgee" "-"
46.x.x.90 - - [17/Jul/2017:05:51:32 +0000]  "HEAD http://x.x.71.1:80/pma2011/ HTTP/1.1" 301 0 "-" "Mozilla/5.0 Jorgee" "-"
46.x.x.90 - - [17/Jul/2017:05:51:32 +0000]  "HEAD http://x.x.71.1:80/pma2012/ HTTP/1.1" 301 0 "-" "Mozilla/5.0 Jorgee" "-"
46.x.x.90 - - [17/Jul/2017:05:51:33 +0000]  "HEAD http://x.x.71.1:80/pma2013/ HTTP/1.1" 301 0 "-" "Mozilla/5.0 Jorgee" "-"
46.x.x.90 - - [17/Jul/2017:05:51:33 +0000]  "HEAD http://x.x.71.1:80/pma2014/ HTTP/1.1" 301 0 "-" "Mozilla/5.0 Jorgee" "-"
46.x.x.90 - - [17/Jul/2017:05:51:33 +0000]  "HEAD http://x.x.71.1:80/pma2015/ HTTP/1.1" 301 0 "-" "Mozilla/5.0 Jorgee" "-"
46.x.x.90 - - [17/Jul/2017:05:51:33 +0000]  "HEAD http://x.x.71.1:80/pma2016/ HTTP/1.1" 301 0 "-" "Mozilla/5.0 Jorgee" "-"
46.x.x.90 - - [17/Jul/2017:05:51:33 +0000]  "HEAD http://x.x.71.1:80/pma2017/ HTTP/1.1" 301 0 "-" "Mozilla/5.0 Jorgee" "-"
46.x.x.90 - - [17/Jul/2017:05:51:33 +0000]  "HEAD http://x.x.71.1:80/pma2018/ HTTP/1.1" 301 0 "-" "Mozilla/5.0 Jorgee" "-"
46.x.x.90 - - [17/Jul/2017:05:51:33 +0000]  "HEAD http://x.x.71.1:80/phpmyadmin2011/ HTTP/1.1" 301 0 "-" "Mozilla/5.0 Jorgee" "-"
46.x.x.90 - - [17/Jul/2017:05:51:33 +0000]  "HEAD http://x.x.71.1:80/phpmyadmin2012/ HTTP/1.1" 301 0 "-" "Mozilla/5.0 Jorgee" "-"
46.x.x.90 - - [17/Jul/2017:05:51:34 +0000]  "HEAD http://x.x.71.1:80/phpmyadmin2013/ HTTP/1.1" 301 0 "-" "Mozilla/5.0 Jorgee" "-"
46.x.x.90 - - [17/Jul/2017:05:51:34 +0000]  "HEAD http://x.x.71.1:80/phpmyadmin2014/ HTTP/1.1" 301 0 "-" "Mozilla/5.0 Jorgee" "-"
46.x.x.90 - - [17/Jul/2017:05:51:34 +0000]  "HEAD http://x.x.71.1:80/phpmyadmin2015/ HTTP/1.1" 301 0 "-" "Mozilla/5.0 Jorgee" "-"
46.x.x.90 - - [17/Jul/2017:05:51:34 +0000]  "HEAD http://x.x.71.1:80/phpmyadmin2016/ HTTP/1.1" 301 0 "-" "Mozilla/5.0 Jorgee" "-"
46.x.x.90 - - [17/Jul/2017:05:51:34 +0000]  "HEAD http://x.x.71.1:80/phpmyadmin2017/ HTTP/1.1" 301 0 "-" "Mozilla/5.0 Jorgee" "-"
46.x.x.90 - - [17/Jul/2017:05:51:34 +0000]  "HEAD http://x.x.71.1:80/phpmyadmin2018/ HTTP/1.1" 301 0 "-" "Mozilla/5.0 Jorgee" "-"
46.x.x.90 - - [17/Jul/2017:05:51:34 +0000]  "HEAD http://x.x.71.1:80/phpmanager/ HTTP/1.1" 301 0 "-" "Mozilla/5.0 Jorgee" "-"
139.x.x.135 - - [17/Jul/2017:06:33:53 +0000]  "GET / HTTP/1.1"302 219 "-" "Mozilla/5.0 (Windows NT 10.0; W0W64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36" "-"
91.x.x.3 - - [17/Jul/2017:06:49:13 +0000] "GET / HTTP/1.0" 301 185 "-" "-" "-"
38.x.x.164 - - [17/Jul/2017:06:54:55 +0000] "GET / HTTP/1.1" 301 185 "-" "Mozilla/5.0 zgrab/0.x" "-"
91.x.x.3 - - [17/Jul/2017:07:48:04 +0000] "GET / HTTP/1.0" 301 185 "-" "-" "-"
139.x.x.204 - - [17/Jul/2017:08:19:50 +0000] "GET / HTTP/1.1" 302 219 "-" "Mozilla/5.0 (Windows NT 10.0; W0W64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36" "-"
139.x.x.204 - - [17/Jul/2017:08:19:50 +0000] "GET /login HTTP/1.1" 301 185 "-" "Go-http-client/1.1" "-"
139.x.x.204 - - [17/Jul/2017:08:19:51 +0000] "GET /login HTTP/1.1" 200 2222 "http://x.x.71.1/login" "Go-http-client/1.1" "-"

Screenshot

I suspected an attack since we don't have any of these paths.

However, the last one says /login. Now, I'm paranoid and wondering what I could do.

  1. Are there any post-attack motions you go through?
  2. How could I see if the perpetrator successfully logged in?
  3. Who is Jorgee?
Improve this question
7
  • 6
    I'd like to point out that you may have forgotten to redact the IP address in the center of the last log line. Posting this as a comment would have been less intrusive.
    – 0A7Fh
    Jul 17, 2017 at 14:58
  • 7
    Don't post screenshots of logfiles. Instead copy the contents directly into your question and use the code formatting option.
    – kasperd
    Jul 17, 2017 at 21:52
  • 1
    screenshots are okay
    – The Onin
    Jul 17, 2017 at 23:12
  • 30
    @Housemd screenshots are not okay. In addition to other reasons such as accessibility, they can't be indexed by search engines like text so they don't help the next person with a similar problem find this question.
    – user15392
    Jul 17, 2017 at 23:15
  • 3
    Recommend the title have the word "attack" changed to "scan". The presented evidence does not indicate an attack took place.
    – zzarzzur
    Jul 18, 2017 at 4:51

3 Answers 3

Reset to default
23

Since you have the logs I suggest that you look for usage of the login form. Did the try to login at all?

Most often this is just a scan that looks for interesting sites and stores them for later use. This behaviour is extremely common and is common place in almost every http log with a internet facing web service.

  1. First of all you should look at the weblogs and see if they actually tried to use the login form at all. If they did, I guess there is some logging done in the web application of that login form?
  2. In the log you posted there is only GET requests. Look for POST requests.
  3. Jorgee is part of the user agent field and is easily customisable by the web client.
Improve this answer
1
  • 1
    A quick google of zgrab shows it to be an addition to zmap, which itself is an internet scanner. This supports your theory of the "attack" just being an everyday scan.
    – Clonkex
    Jul 17, 2017 at 22:40
10

This looks like an open HTTP proxy scan to me. The HEAD or GET request is not normally followed by http://, but only by the local path.

If your server acts as an open HTTP proxy, the attacker is trying to hide behind it and you should close it. This will get your server blacklisted pretty soon.

Make sure your server is not acting as an open proxy, then just ignore it. Any public-facing server gets scanned all the time.

  1. Test if your server is acting as an open proxy. You can use the http-open-proxy from nmap:

    sudo nmap -sS -sV -p 8080 --script http-open-proxy.nse X.X.X.X

  2. The easiest way is to test with telnet:

    telnet X.X.X.X 80

    Wait a few seconds until the connection is established, and then type in your HTTP request:

    GET /login HTTP/1.1
Host:

    Hit return twice and look at the result

    Now most likely anyone can get your login page. That doesn't mean they are in: for that they need to do a POST request with the right username/password parameters. Look out for that request, or successful requests on resources that are behind your login wall.

  3. Jorgee is a vulnerability scanner. You can see the notice on CheckPoint. Basically, it scans the whole internet for vulnerabilities. Your server gets scanned too, but unless you are vulnerable there is nothing to worry about.

Improve this answer
4

What I see there are two different users, one (139.x.x.x network) presumably being a script kiddie running an exploit scanner, and the other (46.x.x.x network) being a presumably legitimate user.

That, and you forgot to anonymize your server's address (45.x.x.x network) in the last line.

Bottom line: Given no other signs of intrusion, no reason to panic.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .