0

i'm testing a webserver on an aws EC2 instance, it has a wordpress stack on it. The domain is configured properly, public static(elastic ip) redirected to main domain as well as the aws public dns. So the website can only be visited by the domain.

While monitoring inbound connections with wordfence i noticed someone visited http://localhost ... How is this possible?? The ip adress refers to a random company in the uk. Do you think its an attempted hack and someone has actually obtained the ssh keypairs to access the localhost or its a false positive by word fence. Bare in mind that the site is only running for about 3 days...

  • If you want to ask a question about something you found in your logs then it's a good idea to quote the log entry in your question. – symcbean Feb 11 '18 at 17:05
1

While monitoring inbound connections with wordfence i noticed someone visited http://localhost ...

It is not fully clear for me what you really saw but I guess that somebody checked if your web server could be used as a proxy to access an internal host. A properly configured web server will not allow this and in this case you could ignore this message as the usual "noise" you get if you connect a system to the internet.

If instead your server would allow such a request then it could be used to bypass existing boundaries: a web server at localhost (or in some internal network) is often considered protected from outside access or authentication is omitted if the access comes from an internal IP address. If the attacker manages to use your web server as a proxy to access internal systems or localhost then the request to the internal server will come from the internal address of your machine (or from localhost when accessing localhost) - and thus from a trusted system. This way the attacker can access internal sites which should not be reachable from outside.

For more information see for example Server Technologies - Reverse Proxy Bypass.

  • That link was interesting. I did use rewrite engine to redirect ip and aws dns requests. Specifically : RewriteCond %{HTTP_HOST} !^example.com$ RewriteCond %{HTTP_HOST} !^(localhost|127.0.0.1). But as you mentioned as well this specific connection seemed to be coming from locally connected machine.. This is only possible with tunnelling or reverse proxy bypass as per your link. What i really don't get is i haven't got similar anomalies for the last 12 years, but a sample site with no real content on aws gets spoofed in 3 days? – CryptoTex Feb 10 '18 at 20:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.