1

We saw URL-decoded PHP code that will probably try to take down our web servers via overflow attack, but we do not know exactly what it does.

The decoded URL string is:

/<?php echo chr(78).chr(69).chr(84).chr(83).chr(80).chr(65).chr(82).chr(75).chr(45).chr(80).chr(72).chr(80).chr(45).chr(48).chr(45).(44353702950 (intval($_GET[997])*4567)).chr(45) ?>

I tried converting the string and ended up with:

NETSPARK-PHP-0-0-
2

It is testing payload for code injection bug by the tool netsparker. Someone might have started the tool on your site to test for PHP code injection.

As can be simulated on writephponline.com :-

url: http://www.writephponline.com/?997=7876876

payload:-

echo chr(78).chr(69).chr(84).chr(83).chr(80).chr(65).chr(82).chr(75).chr(45).chr(80).chr(72).chr(80).chr(45).chr(48).chr(45).(44353702950*(intval($_GET[997])*4567)).chr(45);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.