1

I have a python-script being run regularly on my Linux system by means of a cron daemon process - every weekday 18:00 scraping stockmarket data.

This scraping script is placed in cgi-bin folder so that it can be run on a remote client.

Port 80 is open on the default gateway

Webbserver: Apache2

No domainname is bound to my public IP so the IP is used

So the script is run on a remote client by the following url

xxx.xxx.xxx.xxx/cgi-bin/pytest.py

So - luckily a confirmation mail is sent to my email when the pythonscript is run. Since cron launches this script at 18:00 monday - friday I get this mail.

Today something happended - the script was run 2 times:

  1. 17:56
  2. 18:00

second time is when cron executes the script. But why was it executed 17:56?

I checked the apache access-log and got the following

 37.123.187.232 - - [16/Feb/2021:17:56:27 +0100] "GET /cgi-bin/pytest.py HTTP/1.1" 200 2090 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36"

So someone could execute the script and my question is -

How could someone know about my IP (yes you can portscan IF you know the IP) and even more strange - know the name of the pythonscript?

I can only think of 2 possibilities:

  1. theres a method to systematically scan IP-adresses on internet and check which ports are opened. But how know whats inside cgi-bin?

  2. I sent this url to a friend of mine some weeks ago since he helps me scrape now and then. Could the mailbox be hacked? (I will emphasize that he DID NOT scrape at that point of time)

5
  • Your script is called scrape.py, but that request is for pytest.py. Do you also have such a file? Also, if you don't want others to be able to access the script, why did you make it publicly available? Feb 17 at 11:41
  • @multithr3at3d - just a typo, I edited my question
    – java
    Feb 17 at 12:04
  • 1
    If your script is publicly exposed than i believe there are some cases I can think of like shodan or Google Dork or someone got this info from remote client . Feb 17 at 12:43
  • 2
    cgi-bin is a common and interesting directory, and pytest.py is easily guessable. My servers are probed all the time for common files.
    – ThoriumBR
    Feb 17 at 13:00
  • 2
    If you don't want this, put the script in a directory with a long and random name (SHA1 sum of something is a good one) and rename the script to an equally random name. And use fail2ban to ban everyone that gets an HTTP404 error.
    – ThoriumBR
    Feb 17 at 13:02
3

IP / port scanning is something that is happening on a daily basis. The cgi-bin directory is a standard directory and included in almost if not all wordlists used by directory brute forcing tools such as dirb, dirsearch etc. The cgi-bin directory is also of interest in relation to a know vulnerability ShellShock (read further to see whether your system is vulnerable or not). In regards to the script name, I believe it can be enumerated easily with already mentioned tools. If you care, you could employ firewall rules to restrict who, from where can access it (think of IP based restrictions, or perhaps use a custom User Agent and reject other connections). None of this are bulletproof but can help.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.