2

While checking out some error logs for our site, I noticed one odd-looking request that provided many parameters that we don't use:

'q' => 'die(\'z!a\'.\'x\');',
'w' => 'die(\'z!a\'.\'x\');',
'e' => 'die(\'z!a\'.\'x\');',
'r' => 'die(\'z!a\'.\'x\');',
't' => 'die(\'z!a\'.\'x\');',
'y' => 'die(\'z!a\'.\'x\');',
'u' => 'die(\'z!a\'.\'x\');',
'i' => 'die(\'z!a\'.\'x\');',
'o' => 'die(\'z!a\'.\'x\');',
'p' => 'die(\'z!a\'.\'x\');',
'a' => 'die(\'z!a\'.\'x\');',
's' => 'die(\'z!a\'.\'x\');',
'd' => 'die(\'z!a\'.\'x\');',
'f' => 'die(\'z!a\'.\'x\');',
'g' => 'die(\'z!a\'.\'x\');',
'h' => 'die(\'z!a\'.\'x\');',
'j' => 'die(\'z!a\'.\'x\');',
'k' => 'die(\'z!a\'.\'x\');',
'l' => 'die(\'z!a\'.\'x\');',
'z' => 'die(\'z!a\'.\'x\');',
'x' => 'die(\'z!a\'.\'x\');',
'c' => 'die(\'z!a\'.\'x\');',
'v' => 'die(\'z!a\'.\'x\');',
'b' => 'die(\'z!a\'.\'x\');',
'n' => 'die(\'z!a\'.\'x\');',
'm' => 'die(\'z!a\'.\'x\');',
'eval' => 'die(\'z!a\'.\'x\');',
'enter' => 'die(\'z!a\'.\'x\');',
'cmd' => 'die(\'z!a\'.\'x\');',
(Other valid parameters redacted)

I have two questions about these parameters:

  1. This request appears to be part of a scripted attempt to determine if our code performs a PHP eval() on supplied parameters. Is there anything special about the string z!ax? (Besides, of course, being a string that the script can search for in the server's response)

  2. To your knowledge, does this attack/test belong to a larger battery of well-known attacks? If so, I'd like to run the same tests on our application myself to identify any other weak points the attacker may have identified.

  • 3
    I'd agree with your analysis. It's an attempt to check for PHP code execution and z!ax seems to serve as a unique string to check the response for. The good thing about die() is that the execution is stopped afterwards, so you can conveniently check if the response ends with that string. – Arminius Mar 17 '18 at 21:22
  • I would say it's someone trying to find out if there's a PHP backdoor present. If the page only shows "z!ax" then it's probably present. I also noticed it in the logs of clients I manage. – Technidev Mar 18 '18 at 1:49
  • I recently had this show up in my logs as well for both POST, GET and even cookie. – HelloSpeakman Mar 19 '18 at 10:34
1

Besides, of course, being a string that the script can search for in the server's response.

Thats probably exactly what it is.

[D]oes this attack/test belong to a larger battery of well-known attacks?

There are countless test suites and bots, and it's quite simple to script your own. If you want to know what this particular one is up to, your best bet is to just look through the server logs.

Since it's trying random query parameters, it's probably just a bot black box testing anything that might work. I wouldn't be to worried about it. If you have a server on the internet, this is what you get.

Your desire to battle test your server is commendable though! Doing some pen testing or scanning on yourself is a great idea. I would not pick the scan based on what I find in the logs, though. Find a tool designed for the language and frameworks you are using.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.