5

We created a default environment on AWS Elastic Beanstalk using their Python "sample app". After some time, the logs show a large number of POST requests with bodies like this:

b'0x%5B%5D=ridho'
b'0x%5B%5D=androxgh0st'
b'0x%5B%5D=Graber'
b'0x%5B%5D=anarchy99'

These names smell pretty fishy. I guess %5B%5D encodes square brackets []?

Could someone explain what these people are trying to achieve?

Improve this question
3
  • 5
    I googled one of the names and got this as the top hit: thedfirreport.com/2021/02/28/laravel-debug-leaking-secrets
    – schroeder ♦
    Oct 7, 2021 at 12:59
  • 2
    @schroeder: Thanks! That matches the description nicely: "Detections: Web requests to root/.env or post data that includes 0x[]:androxgh0st (hard coded string in smtp.py)."
    – djvg
    Oct 7, 2021 at 13:45
  • I'm noticing the exact same thing - but I am capturing POST method data on my homepage to monitor what is coming in. I registered a BRAND NEW DOMAIN and this was happening within 2 hours, so clearly these bots have a way to identify new domain registrations. array(1) { ["0x"]=> array(1) { [0]=> string(11) "androxgh0st" } } array(1) { ["0x"]=> array(1) { [0]=> string(6) "Graber" } }
    – Dale Clifford
    Mar 23, 2022 at 6:37

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .