5

If have a firewall on my wordpress site and it has blocked Google from attempting both Local File Inclusion and Directory Traversal attempts. Why would Google be doing this?

United States Mountain View, United States was blocked by firewall for Directory Traversal in query string: filename=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd%2Chttp%3A%2F%2Fwww.MySite.com%2Fwp%2F… at http://www.MySite.com/wp//wp-content/plugins/wp-symposium/server/php/index.php,http://www.MySite.com/wp//wp-content/plugins/w… 14/10/2017 12:43:15 (20 hours 39 mins ago) IP: 66.249.73.207 [block] Browser: undefined Mozilla/5.0 (compatible; Googlebot/2.1; +ttp://www.google.com/bot.html)

United States Mountain View, United States was blocked by firewall for LFI: Local File Inclusion in query string: filepath=%2Fetc%2Fpasswd at ttp://www.MySite.com/wp//wp-content/plugins/simple-image-manipulator/controller/download.php?filepath=%2Fetc%2Fpasswd 14/10/2017 12:43:09 (20 hours 39 mins ago) IP: 66.249.73.207 [block] Browser: undefined Mozilla/5.0 (compatible; Googlebot/2.1; +ttp://www.google.com/bot.html)

2
  • I seems it is not a "unintended" attack. Somebody misuse bots to attack your site. But, it is interesting why he is doing that since he can also do it manually. Oct 15, 2017 at 20:44
  • 1
    I know this is a little bit old, but the reason is likely because a Chrome user is attempting to do these attacks, and you are only logging the Chrome proxy. Chrome sometimes proxies requests through its own servers. Jun 30, 2018 at 17:49

1 Answer 1

8

It might be that somebody is including these links into his page for the Google bot to notice and follow. If you then block the IP address since it looks like attacks you will block the Google bot from indexing your site. And maybe this is what this somebody wants to achieve, i.e. make your site harder to find. It could be a competitor using Blackhat SEO methods or just somebody who does not like you. Another possibility is that this somebody later checks the Google index for the seeded URLs to find out if the Google bot found some interesting content there.

See also Google Bots Doing SQL Injection Attacks from 2013 for a similar problem.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .