While checking out some error logs for our site, I noticed one odd-looking request that provided many parameters that we don't use:

'q' => 'die(\'z!a\'.\'x\');',
'w' => 'die(\'z!a\'.\'x\');',
'e' => 'die(\'z!a\'.\'x\');',
'r' => 'die(\'z!a\'.\'x\');',
't' => 'die(\'z!a\'.\'x\');',
'y' => 'die(\'z!a\'.\'x\');',
'u' => 'die(\'z!a\'.\'x\');',
'i' => 'die(\'z!a\'.\'x\');',
'o' => 'die(\'z!a\'.\'x\');',
'p' => 'die(\'z!a\'.\'x\');',
'a' => 'die(\'z!a\'.\'x\');',
's' => 'die(\'z!a\'.\'x\');',
'd' => 'die(\'z!a\'.\'x\');',
'f' => 'die(\'z!a\'.\'x\');',
'g' => 'die(\'z!a\'.\'x\');',
'h' => 'die(\'z!a\'.\'x\');',
'j' => 'die(\'z!a\'.\'x\');',
'k' => 'die(\'z!a\'.\'x\');',
'l' => 'die(\'z!a\'.\'x\');',
'z' => 'die(\'z!a\'.\'x\');',
'x' => 'die(\'z!a\'.\'x\');',
'c' => 'die(\'z!a\'.\'x\');',
'v' => 'die(\'z!a\'.\'x\');',
'b' => 'die(\'z!a\'.\'x\');',
'n' => 'die(\'z!a\'.\'x\');',
'm' => 'die(\'z!a\'.\'x\');',
'eval' => 'die(\'z!a\'.\'x\');',
'enter' => 'die(\'z!a\'.\'x\');',
'cmd' => 'die(\'z!a\'.\'x\');',
(Other valid parameters redacted)

I have two questions about these parameters:

  1. This request appears to be part of a scripted attempt to determine if our code performs a PHP eval() on supplied parameters. Is there anything special about the string z!ax? (Besides, of course, being a string that the script can search for in the server's response)

  2. To your knowledge, does this attack/test belong to a larger battery of well-known attacks? If so, I'd like to run the same tests on our application myself to identify any other weak points the attacker may have identified.

  • 2
    I'd agree with your analysis. It's an attempt to check for PHP code execution and z!ax seems to serve as a unique string to check the response for. The good thing about die() is that the execution is stopped afterwards, so you can conveniently check if the response ends with that string. – Arminius Mar 17 '18 at 21:22
  • I would say it's someone trying to find out if there's a PHP backdoor present. If the page only shows "z!ax" then it's probably present. I also noticed it in the logs of clients I manage. – Technidev Mar 18 '18 at 1:49
  • I recently had this show up in my logs as well for both POST, GET and even cookie. – HelloSpeakman Mar 19 '18 at 10:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.