2

I recently checked my logs and found some strange requests to my server. eg

GET /path/Microsoft.XMLHTTP HTTP/1.0
GET /path2/Scripting.FileSystemObject HTTP/1.0

A further check seems to point to some robot doing web site archival. Would a web archival bot execute such requests in the form of commands to archive our site?

For example, if it is from Internet Archive or some library which does archival, would these archival bots actually perform such requests ? I though they would just do spidering or grab the whole website, and not invoke such commands.

Update:

Upon further investigation, I found that the archival bot probably went deeper into analysing a javascript at that page and grabbing those statements that contain Scripting.FileSystem, eg

var FSO = new ActiveXObject("Scripting.FileSystemObject");

Probably the reason is the bot needs to get everything that it could find, so even ActiveXobjects. Is it logical to think this way?

  • Why do you think this is a legitimate spider? Doesn't sound like it judging by what it is doing. – Alfred Armstrong Oct 26 '15 at 10:52
  • Still using ActiveX? I hope you aren't expecting any users using other browsers than Internet Explorer before Edge. – Philipp Oct 26 '15 at 11:40
  • @AlfredArmstrong, I do not know how web archival bots work actually. I suppose while trying to get contents off the site, and if those sites make use of javascript in order to display content, then the bot will try to also "simulate" some sort of client side action to get contents ? A normal spider would not be able to simulate javascript client side actions without using some special method? – Pang Ser Lark Oct 27 '15 at 1:29
  • 1
    I don't believe Javascript is executed by archival bots. It would be very expensive and unlikely to be useful. More likely they actively avoid Javascript to reduce the risk of polluting the archive with potential malware. – Alfred Armstrong Oct 27 '15 at 9:51
4

This appears to be a bot looking for common vulnerabilities in websites. Such bots are very commonly run by black-hat hackers to identify potential hacking targets. All websites get scanned by such bots regularly. It is unlikely to be an attack specifically targeted at you.

The only useful defense is to make sure that you don't have any vulnerable web applications on your site. If you use any standard software on your server (on the whole stack from operating system to individual scripts), make sure they are always up to date.

  • 1
    I wouldn't say that's the "only" defense. Such script kiddy attacks will usually run through a set of attempts to break your server, and of they don't succeed will move on to their next victim. WHILE THIS IS NOT A SUBSTITUTE FOR GOOD PATCH MANAGEMENT, running something like Fail2ban with a comprehensive set of attack signatures against your webserver logs provides an additional layer of assurance. – symcbean Oct 23 '15 at 11:55
  • thanks. what if the bot is from an legit source that does archival? Those requests seems very suspicious because it is trying to probe using commands and not doing the normal spidering – Pang Ser Lark Oct 25 '15 at 2:27
  • 1
    @Pang Ser Lark: You can conclude that the archival server you are talking of was hacked. I advise you to report it with the extract from your logs to abuse@archival_server_domain. This may help them. – daniel Azuelos Oct 25 '15 at 16:07
  • hi i have updated my findings. – Pang Ser Lark Oct 26 '15 at 10:22
3

It is very common to see the vulnerability scanner requests in the server logs.

Default pages of all major web, database administration tools, Linux and Windows, are checked sooner or later, regardless of what you are actually using.

The bots look for the default (unchanged) passwords. Bots also try to find other vulnerabilities and check maybe you use outdated software with known security problems.

You can even purchase such such scanner services from some providers. The company will scan your site periodically, simply reporting all discovered issues to you.

  • thanks. what if the bot is from an legit source that does archival? Those requests seems very suspicious because it is trying to probe using commands and not doing the normal spidering – Pang Ser Lark Oct 25 '15 at 2:27
  • No, going to the default admin page and probing a default password there is unlikely to be "from an legit source". – h22 Oct 25 '15 at 10:37
  • hi i have updated my findings. – Pang Ser Lark Oct 26 '15 at 10:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.