Understanding suspicious HTTP GET Request

Question

I was looking through my Apache log files and besides other GET requests with response status codes of 4XX (error), I've found this one which has a 200 (success) response status code:

"GET /?rest_route=/wp/v2/users/ HTTP/1.1" 200 5453 "-" "Go-http-client/1.1"

First of all, the status code 200 doesn't imply that the request was successful in regards to passing a variable successfully, correct? How would I check then, if such a probe/attack was successful? Would I manually need to go into my files and scan through the code if such a request would do something malicious?

Lastly, what was the bot (I assume it is a bot) trying to achieve with this request specifically? Is it trying to get some data about WordPress users?

Answer 1

The reason it counts as "success" is because of the beginning:

/?...

This means the path the server cares about is /, which likely maps to the index of your web application. The query string after, ?rest_route=/wp/v2/users/, is likely ignored by your web application.

In fact, you can try this on a bunch of websites, such as security.stackexchange.com/?rest_route=/wp/v2/users/ and you will get a 200 Success code returned.

How can I check if it was successful?

In this example, thw "/wp/v2/users/" indicates that the attacker was likely trying to exploit a wordpress misconfiguration to retrieve the list of users through a REST API. If you open your page with that URL and see just the normal index, then it's safe to say that attempt failed.

As for a general answer...that's hard to say. The whole field of digital forensics and incident response is about identifying such indicators of compromise.

Answer 2

First of all, the status code 200 doesn't imply that the request was successful in regards to passing a variable successfully, correct?

It depends on what you mean by to pass a variable successfully.

This aside, the HTTP status code 200 just means everything went okay.

What okay specifically means is of course dependent on the application.

You're focusing too much on a detail that isn't really important - it doesn't matter what the HTTP response code (your server sent) is or was.

To clarify:

You can't reliably take HTTP response codes as an indicator of whether an attack was attempted or if it was successful or not. Because that isn't the relevant ; to the attacker it won't matter what the HTTP response code is.

Update:

I want to cross reference another post made on this exchange site (emphasis mine):

Any competent vulnerability scanner won't check for headers or similar information; instead, it'll just try dozens or hundreds of known attacks and checks if one if them works. [...] So, any automated scanner will just try out as much as it can in order to not miss out on anything.

Answer 3

First of all, the status code 200 doesn't imply that the request was successful in regards to passing a variable successfully, correct?

correct

How would I check then, if such a probe/attack was successful?

Do you have Wordpress installed? if yes, you can try this request yourself and see what it returns. You don't need to worry about it, if you dont have Wordpress installed.

Would I manually need to go into my files and scan through the code if such a request would do something malicious? In most cases you just need to know what version you are running of (1) webserver, and (2) web-framework like Wordpress, and whether the version you are running have any exploitable vulnerabilities. If not, you dont need to worry about. If you are running old unpatched software - here is your problem.

This particular request appears to show user list, so by logic next step would be to brute-force or password spray Wordpress admin account, you can check logs if you have a lot of brute-force activity.

Lastly, what was the bot (I assume it is a bot) trying to achieve with this request specifically? Is it trying to get some data about WordPress users?

Most likely the bot is some vulnerability scanner (like Nessus), it is trying thousands of various requests, known to leak information about your system, and collects information about your system's vulnerabilities for further exploitation.