12

I was looking through my Apache log files and besides other GET requests with response status codes of 4XX (error), I've found this one which has a 200 (success) response status code:

"GET /?rest_route=/wp/v2/users/ HTTP/1.1" 200 5453 "-" "Go-http-client/1.1"

First of all, the status code 200 doesn't imply that the request was successful in regards to passing a variable successfully, correct? How would I check then, if such a probe/attack was successful? Would I manually need to go into my files and scan through the code if such a request would do something malicious?

Lastly, what was the bot (I assume it is a bot) trying to achieve with this request specifically? Is it trying to get some data about WordPress users?

2
  • 1
    Visit the URL and see what happens? It's a GET request that will list the usernames of wordpress users. You'll usually see this from automated scanners often called "internet background noise"
    – wireghoul
    Oct 11, 2022 at 21:29
  • 1
    Also, visit / and check your logs - see if the number of bytes transferred (the number after the 200 code) matches. If the parameter has been completely ignored, the size you quote above should probably be the same. If they are different, that indicates that the server has treated the request differently.
    – MikeB
    Oct 13, 2022 at 9:36

3 Answers 3

36

The reason it counts as "success" is because of the beginning:

/?...

This means the path the server cares about is /, which likely maps to the index of your web application. The query string after, ?rest_route=/wp/v2/users/, is likely ignored by your web application.

In fact, you can try this on a bunch of websites, such as security.stackexchange.com/?rest_route=/wp/v2/users/ and you will get a 200 Success code returned.

How can I check if it was successful?

In this example, thw "/wp/v2/users/" indicates that the attacker was likely trying to exploit a wordpress misconfiguration to retrieve the list of users through a REST API. If you open your page with that URL and see just the normal index, then it's safe to say that attempt failed.

As for a general answer...that's hard to say. The whole field of digital forensics and incident response is about identifying such indicators of compromise.

7
  • 15
    "If you open your page with that URL and see just the normal index, then it's safe to say that attempt failed" Even though in this specific case it is likely, in general it is not. You could pass parameters that do not seem to change anything to the page, but in reality wreak havoc on the site (e.g. an SQL injection).
    – jcaron
    Oct 12, 2022 at 12:52
  • 2
    Do you have a link that explains that misconfiguration and how to mitigate it? Asking for a friend...
    – bertieb
    Oct 13, 2022 at 16:07
  • @bertieb I suspect they don't - it's obvious from context. When you open this path on your wordpress site do you get something other than the homepage?
    – user253751
    Oct 14, 2022 at 14:16
  • @user253751 I... that is, my friend sees a list of users in JSON format- but the list of users that have authored [certain types of] posts is public information - the way this is worded implies that listing any users itself is a misconfiguration and exploit
    – bertieb
    Oct 14, 2022 at 17:46
  • @bertieb Presumably someone with wordpress expertise needs to answer it. It's clear to anyone that the GET request is looking to read users using a wordpress exploit and/or quirk; but someone needs to know about wordpress to know how bad that is. Is the same info available anyway at yoursite/wp/v2/users or maybe yoursite/v2/users ?
    – user253751
    Oct 14, 2022 at 17:57
1

First of all, the status code 200 doesn't imply that the request was successful in regards to passing a variable successfully, correct?

It depends on what you mean by to pass a variable successfully.

This aside, the HTTP status code 200 just means everything went okay.

What okay specifically means is of course dependent on the application.

You're focusing too much on a detail that isn't really important - it doesn't matter what the HTTP response code (your server sent) is or was.

To clarify:

You can't reliably take HTTP response codes as an indicator of whether an attack was attempted or if it was successful or not. Because that isn't the relevant ; to the attacker it won't matter what the HTTP response code is.

Update:

I want to cross reference another post made on this exchange site (emphasis mine):

Any competent vulnerability scanner won't check for headers or similar information; instead, it'll just try dozens or hundreds of known attacks and checks if one if them works. [...] So, any automated scanner will just try out as much as it can in order to not miss out on anything.

1

First of all, the status code 200 doesn't imply that the request was successful in regards to passing a variable successfully, correct?

correct

How would I check then, if such a probe/attack was successful?

Do you have Wordpress installed? if yes, you can try this request yourself and see what it returns. You don't need to worry about it, if you dont have Wordpress installed.

Would I manually need to go into my files and scan through the code if such a request would do something malicious? In most cases you just need to know what version you are running of (1) webserver, and (2) web-framework like Wordpress, and whether the version you are running have any exploitable vulnerabilities. If not, you dont need to worry about. If you are running old unpatched software - here is your problem.

This particular request appears to show user list, so by logic next step would be to brute-force or password spray Wordpress admin account, you can check logs if you have a lot of brute-force activity.

Lastly, what was the bot (I assume it is a bot) trying to achieve with this request specifically? Is it trying to get some data about WordPress users?

Most likely the bot is some vulnerability scanner (like Nessus), it is trying thousands of various requests, known to leak information about your system, and collects information about your system's vulnerabilities for further exploitation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.