I have a python-script being run regularly on my Linux system by means of a cron daemon process - every weekday 18:00 scraping stockmarket data.
This scraping script is placed in cgi-bin folder so that it can be run on a remote client.
Port 80 is open on the default gateway
No domainname is bound to my public IP so the IP is used
So the script is run on a remote client by the following url
So - luckily a confirmation mail is sent to my email when the pythonscript is run. Since cron launches this script at 18:00 monday - friday I get this mail.
Today something happended - the script was run 2 times:
second time is when cron executes the script. But why was it executed 17:56?
I checked the apache access-log and got the following
220.127.116.11 - - [16/Feb/2021:17:56:27 +0100] "GET /cgi-bin/pytest.py HTTP/1.1" 200 2090 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36"
So someone could execute the script and my question is -
How could someone know about my IP (yes you can portscan IF you know the IP) and even more strange - know the name of the pythonscript?
I can only think of 2 possibilities:
theres a method to systematically scan IP-adresses on internet and check which ports are opened. But how know whats inside cgi-bin?
I sent this url to a friend of mine some weeks ago since he helps me scrape now and then. Could the mailbox be hacked? (I will emphasize that he DID NOT scrape at that point of time)