1

During monitoring of webserver logs I've stumbled upon those standard probings for wordpress exploits etc, like

No route found for "GET /wp-login.php" (uncaught exception)
No route found for "GET /administrator/" (uncaught exception)
No route found for "GET /admin.php"

which I understand. However sometimes I get GET requests like that one:

No route found for "GET /"   data   ""

that irritates me. What kind of probe is this? This is not a general approach of probing a webserver's response for a 404 page, isn't it? Actually while writing this post I realized it could be a known exploit of some software.

Has somebody more information on this request?

2 Answers 2

1

A GET / may return a default page or a directory listing which can give a lot of extra information to the caller. A default page, in particular, can be used to work out the exact software versions (OS, HTTP server...), which helps in knowing what known vulnerabilities may apply. A directory listing may, in turn, reveal some juicy sub-directories.

1
  • I disagree, this is not a simple GET / request but a "GET /" data " with the " data " data added.
    – Samuel
    Jun 18, 2014 at 18:20
0

Did you find other obvious evidence from a tool automatically trying escape sequences/combining payloads?

This looks a bit like $automatic_scan_tool tried to combine payloads/text escapings/...

3
  • Some of them, like "GET / Result: �Ҳ���Post���ͱ��;" etc but mostly only the whitespace-data-whitespace part above
    – Samuel
    Jun 19, 2014 at 15:03
  • Is it some sort of API back-end, and is there a possibility of badly wirtten clients?
    – friedkiwi
    Jun 19, 2014 at 22:10
  • This is a symfony web framework log view. I doubt that this is legitimate data from the site passing through as all requests which work are well-formed. And the first three routes posted in my thread do definitely not exist.
    – Samuel
    Jun 20, 2014 at 6:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .