7

I've just started receiving several emails per second and I think it's likely someone is trying to exploit my contact form. I've taken steps to protect my site, I'm just curious what it is they're trying to do.

Some examples:

..À¯
sample%40email.tst and sleep(7.738) 
acunetix_wvs_invalid_filename
\";cat /etc/passwd;\"
../../../../../../../../../../windows/win.ini\0.tst
/../..//../..//../..//../..//../..//etc/passwd\0.tst
\";print(md5(acunetix_wvs_security_test));$a=\"

The only one I can really guess at is cat /etc/passwd, after that they don't make much sense. Does anyone have any info or further suggestions?

3
  • 4
    The third and last lines pretty much show all you need to know. They're probably using the Acunetix Web Vulnerability Scanner to test your site and see what vulnerabilities they might be able to exploit.
    – Iszi
    Nov 26, 2013 at 20:20
  • Thanks for that, I didn't think to look for a vendor name and it hadn't show up when I Googled the terms. Nov 26, 2013 at 20:24
  • If someone is interested here I published full list of exploits stokito.wordpress.com/2017/02/23/… Feb 23, 2017 at 13:34

1 Answer 1

7

It looks like an automated fuzzing test/attack that is looking for a number of different vulnerabilities.

Based on what you have provided they are trying to access the file system or execute directory traversal attacks, but I suspect as time goes by they will try basically every type of attack there is.

Tools like Burp Suite will provide ways to automate these types of attacks by allowing you to specify which HTTP parameters you want to target as well as providing an attack payload that looks for a number of different vulnerabilities (SQL Injection, XSS, path traversal etc.)

You can probably block the IP for now, but I would make sure that you site is secure because they will probably be back. Also, you are probably receiving emails because they are testing your "contact us" form or something like that. I would check your logs, because they are likely hitting many other pages as well.

1
  • Thanks for the response. My site is sat behind CloudFlare so I've identified and blocked the offending IP address. This seems to have stopped the attack, for now. Nov 26, 2013 at 20:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.