2

I have my serve set up with AbuseIPDB so I can keep a log of all suspicious request and hacking attempts for my honeypot machine. I noticed an IP that sent a GET request to port 80.

177.154.28.130 - - [07/Jan/2021:12:07:20 -0500] "GET / HTTP/1.1" 200 326 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36"

I had a look at the other requests and noticed the IP with attempting to connect to telnet ports, typical behavior of an infected host. Why did this IP send a request to / on port 80? How does this help the botnet grow?

I'm not interested in preventing this as these connections occur on a honeypot machine, I'm curious as to why they happen in the first place.

Improve this question
3
  • If a site is running a clear text web site with no encryption in this day and age, the odds go up of other insecure or poor configurations.
    – user10216038
    Jan 7, 2021 at 17:52
  • 2
    @user10216038: The pure existence of a HTTP server on port 80 is no indication of a poor configuration. Almost all web sites have also some plain HTTP variant, at least in order to issue a permanent redirect to HTTPS.
    – Steffen Ullrich
    Jan 7, 2021 at 18:19
  • 1
    Does this answer your question? What are the best pratices to avoid my server being port scanned
    – mentallurg
    Jan 8, 2021 at 0:56

1 Answer 1

Reset to default
5

What you observe is part of an initial information gathering, i.e. check what kind of services are running, what software might run on these services etc. Based on this it can be decided if the target might be vulnerable for exploiting and which exploits to try.

... the IP with attempting to connect to telnet ports, typical behavior of an infected host

Connecting to telnet ports is not necessarily a typical behavior of an infected host but can easily be done from a system which is not infected. Checking if telnet works is also part of information gathering.

Improve this answer
1
  • 2
    Often one will do a nc <ip> 80 and then perform a HEAD HTTP request within the netcat connection to get the banner of the sever. As explained by @Steffen Ullrich, this is quite common during information gathering, and very useful during enumeration.
    – Filipe dos Santos
    Jan 8, 2021 at 2:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .