0

I have setup a new set of servers to test a software in Amazon EC2, and had set up my application. I've given it public access and a DNS entry, so its easily reachable by those that need to test it out.

Today I've found the following in the application logs (beside from the regular application requests):

GET /manager/html 404 2ms
HEAD / 200 1ms - 2.65kb
GET /manager/html 404 2ms
GET /w00tw00t.at.blackhats.romanian.anti-sec:) 404 1ms
GET /phpMyAdmin/scripts/setup.php 404 1ms
GET /phpmyadmin/scripts/setup.php 404 0ms
GET /pma/scripts/setup.php 404 1ms
GET /myadmin/scripts/setup.php 404 1ms
GET /MyAdmin/scripts/setup.php 404 1ms
GET / 200 2ms - 2.65kb
GET /w00tw00t.at.blackhats.romanian.anti-sec:) 404 1ms
GET /phpMyAdmin/scripts/setup.php 404 1ms
GET /phpmyadmin/scripts/setup.php 404 0ms
GET /pma/scripts/setup.php 404 1ms
GET /myadmin/scripts/setup.php 404 1ms
GET /MyAdmin/scripts/setup.php 404 1ms
GET /manager/html 404 2ms

I've been reading about software that makes these types of requests, and it seems to be just an automated tool to find vulnerabilities in the system.

Now, I know that only me and a second person have ever accessed this service, it is not published or mentioned anywhere else but Amazon. I also know that none of us is running vulnerability checking against the application.

So I wanted to know before I raise alarms, am I or this other person infected by malware?

1
  • 1
    If you have to expose your EC2 instance to the entire Internet you should consider making a snapshot of it prior to publishing it. Reboot the snapshot instead of the instance and any headway by attackers will be eliminated. Of course a weak system will probably get re-exploited but your baseline will always be available to reuse/harden.
    – zedman9991
    Aug 15, 2014 at 13:04

1 Answer 1

1

No, this is definitely a scanner trying various URLs on the server to see which URL it can find.

For example, if it finds "/phpmyadmin/scripts/setup.php" it knows you have phpmyadmin installed, and where it's installed. The attacker can then find the version, and run a known exploit to get access.

As for how they found it, it could be several ways:

  1. Amazon has a certain IP block assigned for their use. It's publicly known, so you could just hit each IP address in that block.
  2. You could fuzz urls, using a dictionary of words and a dictionary of TLDs.
  3. Google will have indexed the site, as Google is notified of all domain registrations (as per it's status as a registrar (See here for an illustration of the trouble it cas cause)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .