I got scanned yesterday, and I'm seeing a bunch of entries in my logs like /'\"\\'\\\");|]*{%0d%0a<%00>/photos or /'\"\\'\\\");|]*{%0d%0a<%00>/resources. What specific vulnerability was this bot looking for?
The next thing was a bunch of requests for urls like /1%c0%00xa7%c0%a2/about. Not sure what vulnerability was being tested for there either.
The first line is a HTTP response splitting attack, %0d%0a is a CRLF, it is trying to generate 2 responses for the same request: http://en.wikipedia.org/wiki/HTTP_response_splitting
The second line is a path traversal attack like people already mentioned. The characters there are unicode representations of backslash that would make an attack succesful is your site was vulnerable.
I think that this bot was looking for Path traversal attacks.
See this link for more info. It could have been doing that to test for access or to try and fingerprint the web server / web framework in use. Some web frameworks, for example, have specific directories. Once identified, it could either report back or run a more targeted attack.
Path traversal can be particularly dangerous if you can get a web server to serve back a shadow file, for example.
/%22%26cat%20%2fetc%2fpasswd%26%22/. And there was also attempts at fingerprinting - they looked for some standard Wordpress and Drupal files. But I don't understand how those specific strings above would be used for either path traversal or finger printing - they were in there hundreds of times, and always had valid paths at the end - like /about, /contact, or /schedule
Commented
Mar 21, 2014 at 22:27
There are some security modules for popular web apps that attempt to improve security with large sets of Apache mod_rewrite rules. I can imagine some conditionals in those that skip over matches for e.g. /about$ when they should be more thorough in their checks.
If that's the case here, the URL will get through those checks and allow the path traversal or other attack to get processed, barring other mitigations. That's just a hypothesis - I don't know of a specific instance of this.
