I got scanned yesterday, and I'm seeing a bunch of entries in my logs like /'\"\\'\\\");|]*{%0d%0a<%00>/photos or /'\"\\'\\\");|]*{%0d%0a<%00>/resources. What specific vulnerability was this bot looking for?

The next thing was a bunch of requests for urls like /1%c0%00xa7%c0%a2/about. Not sure what vulnerability was being tested for there either.

  • Quick Google yields SQL Injection. Read on – munkeyoto Mar 21 '14 at 20:48
  • Did that search, but none that I found actually explain how that string of characters checks for SQL injection. They're simply mentioned on pages about SQL injection. – Kyle Schmidt Mar 21 '14 at 22:02

The first line is a HTTP response splitting attack, %0d%0a is a CRLF, it is trying to generate 2 responses for the same request: http://en.wikipedia.org/wiki/HTTP_response_splitting

The second line is a path traversal attack like people already mentioned. The characters there are unicode representations of backslash that would make an attack succesful is your site was vulnerable.


I think that this bot was looking for Path traversal attacks.

See this link for more info. It could have been doing that to test for access or to try and fingerprint the web server / web framework in use. Some web frameworks, for example, have specific directories. Once identified, it could either report back or run a more targeted attack.

Path traversal can be particularly dangerous if you can get a web server to serve back a shadow file, for example.

  • No doubt one of the things being tried was path traversal - there were hundreds of requests with the usual /%22%26cat%20%2fetc%2fpasswd%26%22/. And there was also attempts at fingerprinting - they looked for some standard Wordpress and Drupal files. But I don't understand how those specific strings above would be used for either path traversal or finger printing - they were in there hundreds of times, and always had valid paths at the end - like /about, /contact, or /schedule – Kyle Schmidt Mar 21 '14 at 22:27
  • Did you happen to record the user agent of the requests? Might be able to determine if it is a popular one. – CtrlDot Mar 24 '14 at 14:33
  • Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) – Kyle Schmidt Mar 24 '14 at 17:10
  • Guess they changed that.. oh well... – CtrlDot Mar 24 '14 at 19:24
  • They did, but a number of the urls have acunetix in them - so if I was going to make a guess, I'd guess acunetix. – Kyle Schmidt Mar 24 '14 at 19:53

There are some security modules for popular web apps that attempt to improve security with large sets of Apache mod_rewrite rules. I can imagine some conditionals in those that skip over matches for e.g. /about$ when they should be more thorough in their checks.

If that's the case here, the URL will get through those checks and allow the path traversal or other attack to get processed, barring other mitigations. That's just a hypothesis - I don't know of a specific instance of this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.