0

I just noticed in my access.log several POST requests coming from a (hidden) registration sub page that is not accessible via any link. A 'hacker' seems to have posted a form from there (manually it seems), using a random email as input. I received an email notification that I had setup when this happened and started investigating the access log.

Nothing out of the ordinary at first, but what is indeed very strange, is the fact that this IS the IP address of a friend to whom I told to check out the website at around that time. I also have his hotjar recording and he hasn't accessed the hidden registration page nor filled out any form besides browsing a little on the main index page. So it seems that someone or something is using my friend's IP address.

What could the reason for my friend's IP address being shown in the access.log? Has my friend's computer been compromised and a hacker is de facto using their IP to mask theirs? Or is there something else going on? I appreciate any help here to understand this puzzle.

1
  • Is your friends IP address static? Commented May 2, 2022 at 21:16

1 Answer 1

0

There is a lot of factors that could cause a certain IP address to show in your access log.

Let's assume your web server isn't compromised. If it were, you probably wouldn't see any clues in your logs anymore. Under that assumption:

What could the reason for my friend's IP address being shown in the access.log?

The reason is that the computer with the IP address in the access log has accessed the page in question. Simple as that.

What you need to figure out is:

  • what IP address it's coming from. Is it your friend's? If it's a dynamic IP address, someone else could be having it now. If you're using something like NAT, many IP addresses might map to that IP address.

  • why that IP address is accessing that website. If its user cannot remember doing it, the computer they're using could be compromised. It could also be that somehow the registration form is still accessible, and they unwillingly sent off the form, or an extension, or their browser did.

  • why they could figure out where the hidden registration form is. Unless you have directory listings active, or use well known paths, it's not that easy to guess an URL.

Generally, this question is pretty vague and lacks a lot of details, but that's what I'd be doing, in that order.

Other than the fact that you should secure your registration forms anyway. Use reCAPTCHA or something like that. Since you mentioned xss - you obviously need to secure against that too. Basically, you want to be able to leave your registration forms up, without having to constantly worried about what others do. You can't count on network actors to be well-behaved.

3
  • It is not vague. It is exactly that and with it all information that is available to me. Turned out that it was a Chrome Extension for "ethical hacking" that he triggered when being on the site.
    – Majte
    Commented May 4, 2022 at 15:36
  • Vague as in, to really give a good answer, I'd need to know a lot more of your network than what you told me ;) Glad you figured it out tho!
    – Michael
    Commented May 4, 2022 at 16:37
  • Needless to say I hate him for that. I just wanted to share my development in progress and he just abused my trust. Anyhow, thanks for your help...
    – Majte
    Commented May 4, 2022 at 20:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .