I have a website that does not run PHP (management decision) or has wordpress installed. Intermittently, I receive a few requests for wp_login pages that trip my IDS. The requests are served with a 404 and I am sure they are just a bot looking for WP administrative pages to attack further. However, in some cases the GET requests are funny because they contain HTML response from some another server as body. E.g
GET /wp-login.php HTTP/1.1 Host: myhost Keep-Alive: 300 Connection: keep-alive Cookie: charitable_session=<SESSID>;wordpressuser_<ID>=+; wordpresspass_<ID>=+; _wp_session=<SESSID>%7C%7C1472773689; User-Agent: Mozilla/5.0 (Linux; U; Android 2.2) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1 Content-Type: text/html; charset=utf-8 Content-Length: 35870 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en,en-us;q=0.7,es;q=0.3 Accept-Charset: utf-8;q=0.7,*;q=0.7 <!DOCTYPE html> <html xmlns="http://www.w3.org/1999/xhtml" lang="en"> <head> <title>Oops! The page you are looking for does not exist.</title> <meta http-equiv="X-UA-Compatible" content="IE=edge" /> <meta name="generator" content="Flynax Classifieds Software" /> <meta charset="UTF-8" /> <meta name="viewport" content="width=device-width, user-scalable=n o, initial-scale=1, maximum-scale=1" /> <meta name="description" content="" /> <meta name="Keywords" content="" /> <link rel="stylesheet" href="http://tiruvannamalai.co.in/templates/general_wide/css/style.css" />
This answer of stackoverflow says that webserver SHOULD ignore the request body and I am sure my web-server does so.
My question is what possible benefit can somebody derive from such a scan? Is it just a buggy code that pipes response from one scan into another (Seeing that even headers such as
Content-Length are added to request)?