0

Can someone shed light on this logs .

 ****GET /list25/ADMN/Eligibility/EligibilityResponse.aspx _TSM_HiddenField_=ctl00_ScriptManager1_HiddenField&_TSM_CombinedScripts_=%3b%3bAjaxControlToolkit%2c+Version%3d4.1.40412.0%2c+Culture%3dneutral%2c+PublicKeyToken%3d28f01b0e84b6d53e%3aen-US%3aacfc7575-cdee-46af-964f-5d85d9cdcf92%3ade1feab2%3af9cec9bc%3aa0b0f951%3aa67c2700%3af2c8e708%3a720a52bf%3a4a2c8239%3a8613aea7%3a3202a5a2%3aab09e3fe%3a87104b7c%3abe6fb298 443 - 10.160.241.146 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.4506.2152;+.NET+CLR+3.5.30729;+.NET4.0C**

My question is

  1. is this XSS attack?
  2. What action did the user do that made the webserver to log these entries?
  3. if not an attack what these logs all about?
  • which part of the log entry is unexpected? – schroeder Dec 7 '15 at 4:08
  • @neil smithline is this some kind of xss attack or a normal log entry.._TSM_HiddenField_=ctl00_ScriptManager1_HiddenField&_TSM_CombinedScripts_" .... for xss to happen you need to value of the TSM_HiddenField request parameter to be copied into a JavaScript string which is encapsulated in single quotation marks, which is missing in the logs. since the value is missing can i classify these as xss attack or normal one – MS Guy Dec 7 '15 at 4:23
  • Is /list25/ADMN/Eligibility/EligibilityResponse.aspx a legitimate path / route in your application? – thexacre Dec 7 '15 at 4:52
  • @thexacre 9 yes – MS Guy Dec 7 '15 at 5:02
2

I did URL decode on the string you provided.This seems a normal log entry .Below are some of the things I could tell from the log entry:

  • The IP address who tried to browse to this page is 10.160.241.146 on port 443 " to be honest I don't remember if this is one or the one at the start of the log entry, I need to look it up"

  • The browser submitted the following user agent header mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.4506.2152;+.NET+CLR+3.5.30729;+.NET4.0C**

  • The other part is just the URL with parameters being passed.

if that page is not usually visited by your users that might indicate an automated tool trying to specifically look for AJAX Control Toolkit ToolkitScriptManager.cs TSM_HiddenField Field XXS. You should inspect your logs looking for more evidence. You should look at the logs for the offending IP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.