0

We have a Node.js based web application, that has routes like:

myapp.com/posts/[postId]

We tracked strange requests, which lead to 404 on this routes. The requests were to routes like:

/posts/phpinfo.php
/posts/.user.ini
/posts/info.php3
/posts/phptest.php

Neither we're using PHP nor do i know anything about it...

To me it seems that a crawler/bot is requesting these routes, using some PHP related stuff as postIds which makes no sense (to me)...

Is this legit, though useless, or a security related issue?

What could cause this?

0

This is a classic case of an attacker scanning your website to look for any interesting directories or files that may lead to exploitation. I can say that this happens to a very high percentage of websites online.

The hacker is running a not so sophisticated directory scan and is using the .php extension by default.

As mentioned in the comments, this question may be able to give you additional information.

Not the answer you're looking for? Browse other questions tagged or ask your own question.