I have a specific IP that has been iterating through the directories on my site testing for something. Here is an example of what it keeps trying to hit:

http://<site>/<path>/click._submit keypress._submit<br>
http://<site>/<path>/AjaxControlToolkit.Animation.SequenceAnimation cannot be nested inside AjaxControlToolkit.Animation.ParallelAnimation<br>
http://<site>/<path>/AjaxControlToolkit.AlwaysVisibleControlBehavior must have an element<br>

There are many more, but I removed some of the similar ones. This happens over and over from the same IP and across several directories on my site. Reading IIS logs is not one of my strengths. It definitely seems like they are testing for something that can be exploited, but does this look like a familiar technique to anyone?

  • Have you configured a robots.txt file for the site? – Andrew Hoffman Jun 26 '14 at 19:40

It's probably either a crawler or internet background noise (e.g. automated vulnerability scanners). If all those pages actually exist it's a crawler, if not it's a internet background noise.

If it annoys you, you can ban the IP on your firewall. Another option is a Host Based Intrusion Detection system like OSSEC which detects these type of attacks and blocks them automatically on the firewall for a period of time.

  • The pages do not exist. I was mostly curious why try to hit those specific pages. For example, I can see the jquery fancybox has some known vulnerabilities. So, that makes sense to me. However, I have no clue why there was an attempt to hit many of those pages. Also, I thought someone might see it and say "Oh, that looks like a scan from Samurai" :) – Matt Jun 25 '14 at 20:20

Sometimes automated VA scripts generate such things.

Keep in mind that the usual algorithm to determine if a page is XSS vulnerable encompasses testing for other ASCII injections - and the very first thing you do, is HTML code injection.

Now, one should also do some more correlations, indeed. With no further data, this is only a reasonable surmise.


Usually these kinds of attacks are looking for credentials, trying to manipulate your SQL queries. Block the IP in your appliance. The attacker (robot) is probably looking for passwords.

  • 2
    I'm not seeing any SQL stuff there. How did you come to your conclusion? – schroeder Jun 25 '14 at 20:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.