I'm by no means a security expert. I own a very small personal site which I wrote in php mostly for practice and all that.

I noticed a weird url call in my logs


I tried following that url myself but it doesn't go anywhere but a 404.

I don't want to nuke my site from orbit. What are some steps I can take to at least identify if anything has actually happened.

The site is written in symfony 4(for whatever it's worth)

  • "I own a very small personal site which I wrote in php mostly for practice and all that." I'd be careful about that though. If you're still learning then placing it on the internet isn't the best idea. – Jarrod Christman Sep 27 '19 at 17:37
  • Eh, it's a VPS i paid 3$ for. What's the worst that can happen? I don't have personal info there, just some badly written code. – Andrei Sep 27 '19 at 18:26
  • Ah, then you should be fine. It was just a cautionary warning to avoid having important data on it. – Jarrod Christman Sep 27 '19 at 18:46
  • According to every movie I've ever seen, the worst case scenario here involves death, dismemberment, and the extinction of the human race. So yeah, try not to kill us all... – Conor Mancone Sep 27 '19 at 19:59
  • I dunno man, it would sure free up the traffic if that were the case. I can finally find a parking spot. – Andrei Sep 27 '19 at 20:00

This isn't a sign of anything to be concerned about.

As a general rule of thumb you should expect to find all kinds of strange URLs in your logs. This is the normal "background noise" of the internet. In essence, shortly after a server becomes accessible to the internet, automated bots will automatically start scanning it for any number of well known security vulnerabilities. In short, if you were to nuke your server from orbit anytime something strange showed up in your logs, you'd have terrible uptime. 99% of the time the exploits that are being attempted are not even applicable to your particular technology/framework.

In this particular case this doesn't even look especially harmful, although it is possible it is targeting some vulnerability that isn't the usual SQLi or XSS vulnerability.

I would say the main take away from this should be that good application security is very important on the internet, but you certainly don't have any reason to worry on the basis of just this.

  • Jeez, I got scared there for a second. The server did correctly return a 404 in this case. I can only assume it was some automated bot throwing stuff at whatever and seeing what sticks. You've put my mind at a somewhat ease. Thanks. – Andrei Sep 26 '19 at 18:32

Not the answer you're looking for? Browse other questions tagged or ask your own question.