0

Is it possible for a site to host malware such that if a certain page is accessed, Firefox is made to send additional GET requests? I'm seeing traffic for attacks coming from me that I haven't done.

--- clarification

"I" am sending SQL injection strings, when really I am not; ajax can do this?

  • "additional GET requests" could be triggered by using ajax. Nothing special. Could you be a bit more specific? – HamZa Apr 14 '14 at 22:15
3

Yes it can, for example using :

  • Ajax
  • A reference to an external JS or css file
  • An iframe
  • or even a HTTP 302 redirect.

This can be used by online malware to generate trafic for a DDoS Attack.

Note, all those are used for legitimate purpose on many (most) websites, and hence do not imply a malicious behavior.

In response to your edit: Yes, Ajax can do this, although I don't think I've already seen this for SQL Injections (whereas XSS or XSRF for example are frequently exploited this way). Other possibilities might include that your server has been compromised and is used as a proxy by an attacker to conduct SQL Injection attacks, or you are running a Tor exit node that is used by an attacker (whether you know it or not).

0

There's at least one proxy service (trendmicro) that sends occasional duplicates of GET requests as some sort of probe for malware. You shouldn't be alarmed, and your GET requests ought to be idempotent anyway.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.