What is the attacker trying to do? (maybe just spam my form) [closed]

Question

I have a PHP-included form that tells me the URL the customer was visiting when they fill it out. The content of the message was either jibberish or poorly handled by the form. (it looked mostly like this: Утром ÑÐ...) The URL that was reported was URL encoded, I had to decode it twice and this is the (anonymized version of the) result:

http://www.example.com/?param1=value1 [PLM=0] GET http:///?param1=value1 [0,9536,24405] -> [N] POST http://www.example.com//?param1=value1 [PLM=0] GET http://www.example.com/?param1=value1 [0,9536,24405] -> [N] POST http://www.example.com/?param1=value1 [0,0,25521]   0 

I have tried searching Google, but all I find are others asking basically the same thing going back to 2008. What is this?

Answer 1

It looks like the attacker is trying to get your page to spit out some information, such as the full path of your webserver.

For example, if you start using multibyte data in most functions (in PHP at least) which don't start with mb_* then it will throw an error, something along the lines of:

Function does not accept Mutlibyte characters in "/var/www/site/script.php" on line 132

Which then gives the attacker a lot more information about your server, which you don't want them to know.

You can mitigate this by turning error reporting off, or have your own error capturing mechanism.