4

I have a website that does not run PHP (management decision) or has wordpress installed. Intermittently, I receive a few requests for wp_login pages that trip my IDS. The requests are served with a 404 and I am sure they are just a bot looking for WP administrative pages to attack further. However, in some cases the GET requests are funny because they contain HTML response from some another server as body. E.g

GET /wp-login.php HTTP/1.1
Host: myhost
Keep-Alive: 300
Connection: keep-alive
Cookie: charitable_session=<SESSID>;wordpressuser_<ID>=+; wordpresspass_<ID>=+; _wp_session=<SESSID>%7C%7C1472773689;
User-Agent: Mozilla/5.0 (Linux; U; Android 2.2) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1
Content-Type: text/html; charset=utf-8
Content-Length: 35870
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en,en-us;q=0.7,es;q=0.3
Accept-Charset: utf-8;q=0.7,*;q=0.7

<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>

<title>Oops! The page you are looking for does not exist.</title>

<meta http-equiv="X-UA-Compatible" content="IE=edge" />
<meta name="generator" content="Flynax Classifieds Software" />
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, user-scalable=n

o, initial-scale=1, maximum-scale=1" />

<meta name="description" content="" />
<meta name="Keywords" content="" />

<link rel="stylesheet" href="http://tiruvannamalai.co.in/templates/general_wide/css/style.css" />

This answer of stackoverflow says that webserver SHOULD ignore the request body and I am sure my web-server does so.

My question is what possible benefit can somebody derive from such a scan? Is it just a buggy code that pipes response from one scan into another (Seeing that even headers such as Content-Length are added to request)?

Improve this question
2
  • 1
    If you were to run WordPress, it would have been more difficult to notice this request as a bot, because it mocks Safari quite good. It still doesn't explain why the HTML is send (especially in a GET request). Best guess, some random HTML content is used for fuzz testing.
    – Yorick de Wid
    Commented Sep 2, 2016 at 8:18
  • Looks like a bug to me, possibly caused by poor memory management. I can think of no benefit to this.
    – Sam Williams
    Commented Sep 2, 2016 at 15:31

1 Answer 1

Reset to default
2

Could be deliberate, though nothing obvious leaps out from that specific body.

There are techniques like request smuggling that involve subtle protocol violations. See for instance:

http://www.cgisecurity.com/lib/HTTP-Request-Smuggling.pdf

Might be interesting to see if the length of the request body is in fact 35870, or if something interesting appears at that place in the request stream.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .