1

This past week, my traffic logs are showing many hits (usually with repeated tries) for a URL from perhaps 30+ different IP addresses all over the world. This is not a URL that should garner more than a single hit and it should only be accessed via a link from one page which contains rel="nofollow". The URL calls a PHP page whose sole purpose is to redirect to other websites based on the id= query parameter. The page's URL is

mywebsite.com/linkredirect.php?id=434&site=www.creative-science.org.uk

The above link has also shown up in the logs in other forms:

/linkredirect.php?site=www.ausetute.com.au&id=266%25%27/**/aND/**/%278%25%27%3D%273
.. there were about 50 different iterations of this - which is attempting sql injection - but I can't figure out the purpose of it.

/linkredirect.php?id=434&site=www.premieresurgical.com
... this is an invalid link - the id=434 is valid but the "site=" query is invalid

I participate in Project Honeypot and some of the requests are Suspicious & Comment Spammer.

The user agent appears to always be:

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/536.28.10 (KHTML, like Gecko) Version/6.0.3 Safari/536.28.10
 ... or something similar

Perhaps unrelated, my error log shows two attempts at what appears a hack attempt at accessing one of my directories

[Tue Mar 04 21:32:12 2014] [error] [client 199.21.99.113] Directory index forbidden by Options directive: /home/myusername/public_html/

What kind of attack is this and what is the purpose? Why bother with repeated attempts to the same link? Is my use of id= as a query parameter an invitation for malicious code to attempt to exploit?

  • 1
    That IP in the last line you quote seems to belong to the Yandex spider (search engine). – Joan Charmant Mar 5 '14 at 11:13
  • btw, you would probably want to change the filename at your question to be more vague(change its name at here only) though, as I can find your site through a simple Google query. – wcypierre Mar 5 '14 at 14:51
  • "change the filename at your question" - Which filename are you referring to? Note that the sites referenced as in site=www.creative-science.org.uk are not mine. – mseifert Mar 5 '14 at 19:41
  • 1
    Let's go through Google Dork lesson #1 then. Try and search using this query and see if it is your site. google.com/search?q=filetype:php inurl:linkredirect.php?id=434 – wcypierre Mar 6 '14 at 4:44
4

It seems like someone wants to test your site for security flaws.

As you said

linkredirect.php?site=www.ausetute.com.au&id=266%25%27//aND//%278%25%27%3D%273

is definitely a try for SQL Injection, %25%27%278%25%27%3D%273 is Hex value for %''8%'='3. You can try decoding the whole request in the form at bottom of this page.

Some attackers use the search engine to find interesting parameter names, using Google for this techniques is know as Google dorks. If you go through first few entries of this list, you can come to know how good the parameter id can attract attackers. Using different parameter name could help you from being away from bots/attackers who use above discussed technique.

  • 1
    I had decoded the injection but didn't understand what it was doing. Injecting %'//aND//'8%'='3 didn't make sense to me. The link you provided was excellent and explained: Blind SQL Injection detection (this shouldn't give us the same result if filtering is in place as we would get if we excluded the AND 1 = 1 part. If it does give us the same result it shows that the application is vulnerable). Now I see that injecting and comparing before and after results can reveal vulnerabilities. Also, thank you for the term "Google dorks". I can't believe this is new to me. I've got homework to do... – mseifert Mar 5 '14 at 20:10
  • I am happy that my answer helped you in some way. If you want to keep up with attackers, you can follow the updates in this site exploit-db.com and can learn about different possible attacks. – Cyril Mar 6 '14 at 5:25
3

Probably that it is just a scanner or the attacker itself that searches uses Google Dork and happened to found your site so the attacker will try to find vulnerabilities at it.

If the attack patterns are repeated then most probably that it is a scanner.

I believe that the Google Dork that is used would be similar or the same as this: filetype:php inurl:".php?id="

To answer your question, the parameter "id" is pretty common, as you can see here

For the different IP addresses, probably that he is using a proxy program that changes the proxy every "n" minutes to avoid blocks from your WAF(if you have one).

As for this question:

[Tue Mar 04 21:32:12 2014] [error] [client 199.21.99.113] Directory index forbidden by Options directive: /home/myusername/public_html/

It is simply an error that will be shown at your error log when directory listing is disabled at a particular folder and someone tries to access that folder without specifying a file within that folder(site.com/folder - forbidden, site.com/folder/file - valid). It is mainly used to block other users from viewing the list of files and folders at that particular path, so the attacker will not be able to test the files at that folder for vulnerabilities, unless the attacker gets a hold of the filename of a file inside that path(whcih can be gained through filename bruteforcing, but it is typically only for files that are common like index.php and such).

  • Thank you for the informative answer. It steers me in the right direction. – mseifert Mar 5 '14 at 20:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.