3

Starting yesterday, my honeypot has been getting a ton of git scans. I normally wouldn't think much of this, but a few weird things are happening:

  • All of the IP addresses come from Amazon AWS
  • They are all looking for the same two SHA-256 hashes
  • They don't appear on any blocklists for .git vulnerability scanning or scanning on TCP/80
  • They scan in 10-20 minute intervals, 24/7 starting yesterday

Here is one of the requests:

13.53.169.41 - - [13/Mar/2021:02:50:00 -0500] "GET //.git/objects/d4/76022a4dfadca6614620e5c15a17ae5cf8a80a HTTP/1.1" 404 179 "-" "curl/7.61.1"

logs

What is the deal with this? Why are they searching for a specific hash?

If I was going to scan the internet for open .git folders, I would search for a generic config file for header file, not a random hash.

I don't care much about this traffic, I'm just curious as to why I'm seeing what appears to be almost a coordinated attack.

Improve this question

2 Answers 2

Reset to default
2

Just a guess, but somebody may be looking for machines where a specific piece of software has been installed using git. It could be software that has a vulnerability, that they are seeking to leverage. In other words, a reconnaissance effort.

Interesting that they didn't even bother to spoof the user agent.

Improve this answer
2

I can think of two other possibilities (below).

One important piece of information left out of your logs is the Host header in the HTTP request. If the requests are using the IP address of your web server then those requests are probably looking for a specific vulnerability as @anonymous mentioned. It would be bad form to hard code IP addresses that perform a check like this. However, being they are such specific requests it also seems likely there's a misconfiguration somewhere.

Recycled IP Address

The IP address of your web server was formerly used to host something that these curl requests are trying to consume. Cloud IP address get recycled so it's not uncommon to see traffic from what it was previously used for.

DNS Misconfiguration

DNS misconfiguration is also a possibility. Someone may have:

  • Registered the wrong record.
  • Failed to update a record.
  • Long TTL hasn't expired.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .