3

I am in the process of developing a php/mysql based web application. I took the complicated route and rather than to use a framework or anything I built the entire foundation of my app from scratch. This all while I learned how to REALLY code (I knew very little, now I'm quite advanced. But faaar from expert or professional I think...)

I made myself custom 404 error pages, which record the URL the user tried to see, the URL they came from, and all variables that are active in the context, including IP address. This is to track down errors on my site, and to kinda detect hacking attempts.

Ever since I've put a BETA version of my site live like 5 months ago, I've had a few (less than 3) bots come by, trying to get access to wp-login.php Usually those were not more than 5 requests made and quite certainly from a bot, because of how fast the requests were made.

Those didn't bother me much (eventhough I did report the on IP to godaddy, because their name showed up with it). Since I don't use wordpress and the directories that were attempted for penetration don't even exist.

Today however an IP address located in Spain spent 20 minutes on my site and made over 60 requests to URLS like

  • /base/captcha/index/
  • /join
  • /signup.php
  • /register.php%22%3E%3Cspan
  • /?page=login&cmd=register
  • /sign_up.html
  • /action/sign_up
  • /modules.php?app=user_reg
  • /index.php?app=home&mod=public&act=register
  • /index.php?app=home&mod=Public&act=isEmailAvailable
  • /reg.asp?reg=reg
  • /ucp.php?mode=register&change_lang=en
  • /member/register
  • /includes/captcha.php
  • /login.php?part=register&action=person
  • /User/Register.aspx

The list goes on and on...

I am uncertain if this was an automated attack or if there was a person actually trying each URL, since it's only about 3 requests per minute.

Fortunately none of those requests yielded any results, since most of them were targeted to non existing directories, those that tried to pass GET variables did not have an effect, because those variables wouldn't have been used by my scripts.

So while I am a little proud of myself, that such an elaborate attack has not done anything, which shows me that my code base is quite solid, and not easily to penetrate, I am also nervous because a bit I feel like I might have gotten lucky that I use rather unconventional directories and file names... I was very mindful of security when programming my application, but I feel so weak, because of my background...

Also I wonder what the hacker's goal was to try all these URLs. It's free to register an account on my site... ?! And the exploits of my site are currently super duper low... only about a hundred email addresses is about the most valuable thing I have in my DB.

The entrepreneur in me is thinking that a competitor of mine tried to penetrate my site... :-D

So besides the highlighted indirect questions, my main questions are:

What should I do with the information I got today?

Should I put mechanisms in place that simply block IPs after a certain number of unsuccessful page requests within a certain amount of time?

Is anyone familiar with this specific attack?

Improve this question
4
  • 11
    I think labeling this is "elaborate" is a gross overestimation of the amount of effort likely being put into it. You should also look at your web server's logs to see about the successful visits by that IP, as those might be much more interesting.
    – Kitsune
    Sep 21, 2013 at 23:36
  • Oh, wow, thanks for pointing that out... (Of course elaborate is compared to what I have been getting). The reporting tool that my web host offers shows 115 requests from this IP address! I guess 50 requests must have been successful... Just checked the log files however, nothing serious on there... I would like to upvote your comment, but there is no button for it!
    – oliver_siegel
    Sep 22, 2013 at 2:14
  • All great answers, thanks guys, helped a lot to clarify things! I feel like a detective being able to get so much information out of the attack, server logs, and my reports! :D I found useful information in everyone's answer, would upvote if I could! Will accept the answer that directly answered my questions the most. Thanks everyone!
    – oliver_siegel
    Sep 22, 2013 at 21:30
  • these scannings (and blocking of such stuff) is the reason why we use a simple WAF that blocks 100-300 scans/day on each website.
    – that guy from over there
    Sep 23, 2013 at 6:31

3 Answers 3

Reset to default
8

Welcome to the wild wild interwebs.

Both the attacks you described seem pretty much automated scans done via some tool. Some tools can even throttle the requests to avoid detection by IDS so that could be a reason for a slow request rate of the scan you mentioned.
This specific scan you mentioned appears to sniff for presence of a forum software on your website. ( e.g. ucp.php is a phpBB forum file).

I wonder what the hacker's goal was to try all these URLs

The attacker's goal here is to identify the framework/scripting language/software running on this domain.

What should I do with the information I got today?

Well, if you are curious to know more about the intentions behind these attacks, you could search the IP address on google and check if there are any known instances of attacks from this IP.
For example, I just checked my server logs for such automated scanning in past 1 hour and I saw extensive scans from this IP 88.190.60.68. Searching this on google immediately led me to this report and this page which detail more about this rouge IP and its activities. So at least I can rest assured that this wasn't an targeted attack (most are not).

If you want to go a step further, you could install software like fail2ban and configure it to automatically detect such scans and blacklist the IP address for a specified duration of time.

Is anyone familiar with this specific attack?

I am afraid you might see more of such scans as your site (domain) gets popular/old. There are tonnes of scripts with various intentions. Some try to find comments/feedback pages where they can just post link spams. Others might be looking for some very specific vulnerability.

Improve this answer
1
  • Haha, wild wild interwebs... :D I did not find the IP on this site, and Googling for this particular IP didn't yield any results either... But you are right, the attack does definitely not seem targeted, and most likely it was just to post spam.
    – oliver_siegel
    Sep 22, 2013 at 21:28
1

It would probably pretty safe to say that this was an automated scan looking for known scripts with vulnerabilities. In all honesty, this has nothing to do with your ability to code, but the laziness of script kiddies looking for flawed websites.

An attacker will most likely have no idea what scripts, frameworks, apps, and services are running on your server if you block certain header attributes in accordance with best practices. They will need to guess by trying all known framework directory structures and key files (like wp-config.php) and hoping for a 200 OK response from the HTTP server. If they get back a 200, they know that script is active, and they can start narrowing down on known security flaws, for example, if they find wp-config.php they can try remote inclusion to get your vars, they can try to find wp-ajax.php to backdoor or water hole your site, etc.

Pretty much, take what you learned from the attack, and code against it. Don't name any of your files or routes with frequently scanned files and directories. By staying below the water, you can hopefully keep your code safe for just a little bit longer.

Improve this answer
0

Is anyone familiar with this specific attack? By looking at the requests, I would venture to say that you were visited by a registration bot.

What should I do with the information I got today? Yes, there are ways that you can use this information to manage/protect your server, but that is a much longer conversation and depends heavily on your network, your security needs, and your need to support clients/customers.

Sort of acting on the information (e.g. autoban/autoblock by IP et cetera) you can, at the very least, monitor what is happening. This too is a long conversation and a myriad approaches that will depend upon the same major aspects (network, security, & support) mentioned above.

If you are not already using some sort of analytics package across your website then I would say that would be the most useful and thing you could do- it would double as a reporting mechanism for your legitimate users as well as any unwelcome visitors.

Improve this answer
2
  • I am using Google Analytics, it only showed one visitor for that day...? My webhost has AWstats installed, which esentially makes the log files easy to view. Nothing much helpful I got from either tool though. Directly looking into the log file and my error page report were more revealing.
    – oliver_siegel
    Sep 22, 2013 at 21:21
  • I think you are definitely right about this being a registration bot... It seems to also have tried to send some POST data to some of my registration and account recovery forms. It must have gotten stuck in the honey pots or was not able to read the obscured text! :)
    – oliver_siegel
    Sep 22, 2013 at 21:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .