This question already has an answer here:

I have set up an Apache/2.2.22 (Debian) Server on my Rasberry Pi. Looking at my access.log, I see a bit of strange activity consisting mostly of GETs, which is quite disconcerting as I am a complete newbie in such matters. The strangest thing was a series of POSTs consisting of percentage signs and numbers. I know next to nothing about web technologies, but I assumed they were escaped HTML characters. Decoding the characters of one of them (there were 2 varieties) from "POST php-cgi?" forwards, it resulted in the following:

"POST /cgi-bin/php-cgi?-d+allow_url_include=on+-d+safe_mode=off+-d+suhosin.simulation=on-d+disable_functions=""+-d+open_basedir=none+-d+auto_ prepend_file=php://input+-d+ cgi.force_redirect=0+-d+cgi. redirect_status_env=0+-n"

And a sample GET:

"GET /HNAP1/ HTTP/1.1"

What is going on here? Are bots randomly testing IP addresses for vulnerabilities? Should I be worried?

Edit: these requests returned 404.

marked as duplicate by Xander, Steve, TildalWave, Adi, GdD Jan 21 '14 at 14:11

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • @mods: i'm part of IT security for ~6 months now and i see the very same question occure every then and there, and i see the same answers every then and there; cant we just make a generic answer for this type of "oh, whats going on? my webserver-logs looks strange!!!!11!" - question? – that guy from over there Jan 20 '14 at 20:19

The first one looks like CGI injection.

Is your PHP updated? Are you sure it doesn't exist in the cgi-bin directory? These two should be enough to protect against this attack....

The second one appears to be targeting some D-Link vulnerabilities. I wouldn't worry about that one on your webserver.


HNAP is the Home Network Administration Protocol.

There are exploits against D-Link routers that can be found using GET requests a bit like this.

You can find more info in this published exploit: http://www.sourcesec.com/Lab/dlink_hnap_captcha.pdf

  • Uh-oh, I have a D-Link router (GO-RT-N150). – Atuos Jan 20 '14 at 18:17

For more details about PHP-CGI vulnerability please refer :-

  • This is essentially a link only answer. Please include the pertinent details in your post. – Xander Jan 20 '14 at 19:17

Sounds like Zollard. It targets FastCGI deployments of PHP. If you run PHP, ensure that your webserver and PHP are up-to-date, and you should be fine.

Not the answer you're looking for? Browse other questions tagged or ask your own question.