5

If have a firewall on my wordpress site and it has blocked Google from attempting both Local File Inclusion and Directory Traversal attempts. Why would Google be doing this?

United States Mountain View, United States was blocked by firewall for Directory Traversal in query string: filename=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd%2Chttp%3A%2F%2Fwww.MySite.com%2Fwp%2F… at http://www.MySite.com/wp//wp-content/plugins/wp-symposium/server/php/index.php,http://www.MySite.com/wp//wp-content/plugins/w… 14/10/2017 12:43:15 (20 hours 39 mins ago) IP: 66.249.73.207 [block] Browser: undefined Mozilla/5.0 (compatible; Googlebot/2.1; +ttp://www.google.com/bot.html)

United States Mountain View, United States was blocked by firewall for LFI: Local File Inclusion in query string: filepath=%2Fetc%2Fpasswd at ttp://www.MySite.com/wp//wp-content/plugins/simple-image-manipulator/controller/download.php?filepath=%2Fetc%2Fpasswd 14/10/2017 12:43:09 (20 hours 39 mins ago) IP: 66.249.73.207 [block] Browser: undefined Mozilla/5.0 (compatible; Googlebot/2.1; +ttp://www.google.com/bot.html)

  • I seems it is not a "unintended" attack. Somebody misuse bots to attack your site. But, it is interesting why he is doing that since he can also do it manually. – d36f Oct 15 '17 at 20:44
  • 1
    I know this is a little bit old, but the reason is likely because a Chrome user is attempting to do these attacks, and you are only logging the Chrome proxy. Chrome sometimes proxies requests through its own servers. – Cillian Collins Jun 30 '18 at 17:49
8

It might be that somebody is including these links into his page for the Google bot to notice and follow. If you then block the IP address since it looks like attacks you will block the Google bot from indexing your site. And maybe this is what this somebody wants to achieve, i.e. make your site harder to find. It could be a competitor using Blackhat SEO methods or just somebody who does not like you. Another possibility is that this somebody later checks the Google index for the seeded URLs to find out if the Google bot found some interesting content there.

See also Google Bots Doing SQL Injection Attacks from 2013 for a similar problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.