What kind of attack is this?

Question

This past week, my traffic logs are showing many hits (usually with repeated tries) for a URL from perhaps 30+ different IP addresses all over the world. This is not a URL that should garner more than a single hit and it should only be accessed via a link from one page which contains rel="nofollow". The URL calls a PHP page whose sole purpose is to redirect to other websites based on the id= query parameter. The page's URL is

mywebsite.com/linkredirect.php?id=434&site=www.creative-science.org.uk

The above link has also shown up in the logs in other forms:

/linkredirect.php?site=www.ausetute.com.au&id=266%25%27/**/aND/**/%278%25%27%3D%273
.. there were about 50 different iterations of this - which is attempting sql injection - but I can't figure out the purpose of it.

/linkredirect.php?id=434&site=www.premieresurgical.com
... this is an invalid link - the id=434 is valid but the "site=" query is invalid

I participate in Project Honeypot and some of the requests are Suspicious & Comment Spammer.

The user agent appears to always be:

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/536.28.10 (KHTML, like Gecko) Version/6.0.3 Safari/536.28.10
 ... or something similar

Perhaps unrelated, my error log shows two attempts at what appears a hack attempt at accessing one of my directories

[Tue Mar 04 21:32:12 2014] [error] [client 199.21.99.113] Directory index forbidden by Options directive: /home/myusername/public_html/

What kind of attack is this and what is the purpose? Why bother with repeated attempts to the same link? Is my use of id= as a query parameter an invitation for malicious code to attempt to exploit?

Answer 1

It seems like someone wants to test your site for security flaws.

As you said

linkredirect.php?site=www.ausetute.com.au&id=266%25%27//aND//%278%25%27%3D%273

is definitely a try for SQL Injection, %25%27%278%25%27%3D%273 is Hex value for %''8%'='3. You can try decoding the whole request in the form at bottom of this page.

Some attackers use the search engine to find interesting parameter names, using Google for this techniques is know as Google dorks. If you go through first few entries of this list, you can come to know how good the parameter id can attract attackers. Using different parameter name could help you from being away from bots/attackers who use above discussed technique.

Answer 2

Probably that it is just a scanner or the attacker itself that searches uses Google Dork and happened to found your site so the attacker will try to find vulnerabilities at it.

If the attack patterns are repeated then most probably that it is a scanner.

I believe that the Google Dork that is used would be similar or the same as this: filetype:php inurl:".php?id="

To answer your question, the parameter "id" is pretty common, as you can see here

For the different IP addresses, probably that he is using a proxy program that changes the proxy every "n" minutes to avoid blocks from your WAF(if you have one).

As for this question:

[Tue Mar 04 21:32:12 2014] [error] [client 199.21.99.113] Directory index forbidden by Options directive: /home/myusername/public_html/

It is simply an error that will be shown at your error log when directory listing is disabled at a particular folder and someone tries to access that folder without specifying a file within that folder(site.com/folder - forbidden, site.com/folder/file - valid). It is mainly used to block other users from viewing the list of files and folders at that particular path, so the attacker will not be able to test the files at that folder for vulnerabilities, unless the attacker gets a hold of the filename of a file inside that path(whcih can be gained through filename bruteforcing, but it is typically only for files that are common like index.php and such).