26

I have captured some web attacks. I am trying to understand what purpose does each attack request achieve.

GET /site/public/timing?<!+XSS="><img+src=xx:x+onerror=alert(14721850.00337)//"> HTTP/1.1" 200 6718

GET /site/public/timing?<sVg/OnLOaD=prompt(14721850.00307)> HTTP/1.1" 200 6718

GET /site/race/registrationAuth/1761?x"+onmousemove=" HTTP/1.1" 302 -

GET /site/registration/create/3269?execution=e1s1'+(select*from(select(sleep(3)))tw)+' HTTP/1.1" 302 -

GET /site/registration/create/3269?execution=e1s1%20waitfor delay'0:0:3'
|improve this question
  • My guess is the same as the answers below. Looks like someone is running an automated tool against your server. The dead give away for me is the prompt. If you were punching that command into a header in order to test a site, would you use a long decimal number or would you just use something simple like "it works" lol – Anthony Russell Aug 29 '16 at 11:41
  • how many sites have 3 pages called "public" "race" and "registration"? It is likely someone is able to find the URL of your site if that combination is unique – GameDeveloper Aug 29 '16 at 16:46
  • 2
    @DarioOO, automatic scanners often probe for URLs that don't actually exist. Many CMSs will respond to an unknown URL with something other than a 404. – Mark Aug 30 '16 at 3:58
40

This looks like automated attacks to test for different injection vulnerabilities. As far as I can tell, there is no actual mallicious payload here. The attacks are instead design to detect if the site is vulnerable. I asume that sites will be attacked with real payloads if the tests are positive.

The first three are XSS attacks. The first two will try to pop up a prompt with the number 14721850.00337 in it. If you multiply that number by 100 you get a Unix timestamp that was three days ago. I guess it is used for timing the attack somehow.

Some common tricks to fool filters are employed - mIxeD CAsE, prompt instead of alert, / instead of space.

The forth and the fifth tests for SQL injection. It tries to make the database server "sleep" for a while. That makes it easy to check if the attack was successful. If it takes a couple of seconds to get a reply, it worked. I think the forth one is aimed at MySQL and the fifth at MSSQL, but they might work on other systems as well.

So do you need to be worried? Not really. This kind of automated attacks are common against any internet facing servers. It does not need to mean that someone is actively attacking you specifically, or that you are vulnerable. But still, it is probably a good idea to test if the attacks work or not, because if they did you can be sure that they have been exploited by now.

|improve this answer
  • What's wrong with injecting the malicious payload as well (if it doesn't slow down the request considerably)? Wouldn't it allow the attacker to both test for vulnerability and attack the server together? – Abdul Aug 29 '16 at 15:37
  • 13
    In some situations maybe, but mostly no. Take the SQLi case. To craft a successfull attack you need to take all sorts of things into consideration - what DB is it, what table structure, what SQL is it injected into, etc, etc. It takes time and effort to figure that out. Just doing a sleep test lets you know if it is injectable, so you know if you should excert the time and effort. – Anders Aug 29 '16 at 16:21
11

All of these request look to be coming from an automated testing tool. Contrary to what some comments are saying, the delays are not malicious, just to blindly test for code execution; if you can't see a response, having it sleep for a set number of seconds is a reliable test.

GET /site/public/timing?<!+XSS=">    <img+src=xx:x+onerror=alert(14721850.00337)//"> HTTP/1.1" 200 6718
GET /site/public/timing?<sVg/OnLOaD=prompt(14721850.00307)> HTTP/1.1" 200 6718

XSS attempts, tries to alert 14721850.00307 / 337 to see if the page is vulnerable.

GET /site/race/registrationAuth/1761?x"+onmousemove=" HTTP/1.1" 302 -

Somewhat unclear, no functional code. Looks like XSS using an event handlert to circumvent filters

GET /site/registration/create/3269?execution=e1s1'+(select*from(select(sleep(3)))tw)+' HTTP/1.1" 302 -

MySQL v5 attack. Despite the SELECT statement, it only tries to let the server sleep for 3 seconds to see if it's vulnerable. 

GET /site/registration/create/3269?execution=e1s1%20waitfor delay'0:0:3'

Microsoft SQL Server attack. Same story, no malicious code, just a single 3s delay.

|improve this answer
  • "delays are not malicious, just to blindly test for code execution; if you can't see a response, having it sleep for a set number of seconds is a reliable test" - Can you rephrase or explain this please? I'm not sure why, but I'm having difficult time wrapping my head around what it means. Are you saying it's (the purposeful delays) nothing malicious, but rather that it's just delayed purposefully to wait for code to execute? – Abdul Aug 29 '16 at 17:06
  • 1
    @Abdul, if the server responds immediately, you know the injection failed. If it takes a few seconds to respond, it's likely the injection succeeded. – Mark Aug 29 '16 at 21:15
  • 2
    What @Mark said. Basically, if the response takes < 3 seconds (all but the slowest servers should, especially if they're just 404ing) the attack failed; if the response takes > 3 seconds, chances are the attack succeeded, and the server is worth a second look by the attacker. – Doktor J Aug 30 '16 at 3:45
2

1 & 2: Some XSS injection

3: Most likely an XSS as well

4: SQL injection (database dump)

5: T-SQL injection (SQL probe)

Remeber some bots just throw stuff behind an url to see if something gets back, these are non specific targets (fuzz testing). Received headers are then checked for either 200 or some other non error HTTP code. Also, by randomizing the GET request, the attacker can ingore cached results or bypass security measures.

|improve this answer
2

Not 100% certain about these, but the first and second look like scripting attacks. They're both trying to inject JavaScript that issues an alert or a prompt with a particular number - nothing harmful in itself, but it's testing if this is possible.

The third one is trying to add an onmousemove event. I think it's trying to make the user send a request every time they move their mouse. Why does that smell like a denial of service attack?

The fourth one looks like a SQL injection: it's requesting everything from the results of another query. I'm not sure what that other query does, but I think it's meant to wait three seconds and do nothing.

The fifth one is a blind SQL injection. This one is telling a SQL Server database to wait for three seconds; if it returns successfully, then the database can attacked.

|improve this answer
  • 1
    I don't think a single 3 second sleep is a Denial of Service. If that were an effective way (it's not, think multithreading), why not specify the largest number possible? – J.A.K. Aug 29 '16 at 9:57
  • 1
    @J.A.K. I didn't think about that. I'll remove that line. – Philip Rowlands Aug 29 '16 at 10:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.