0

I have setup a new set of servers to test a software in Amazon EC2, and had set up my application. I've given it public access and a DNS entry, so its easily reachable by those that need to test it out.

Today I've found the following in the application logs (beside from the regular application requests):

GET /manager/html 404 2ms
HEAD / 200 1ms - 2.65kb
GET /manager/html 404 2ms
GET /w00tw00t.at.blackhats.romanian.anti-sec:) 404 1ms
GET /phpMyAdmin/scripts/setup.php 404 1ms
GET /phpmyadmin/scripts/setup.php 404 0ms
GET /pma/scripts/setup.php 404 1ms
GET /myadmin/scripts/setup.php 404 1ms
GET /MyAdmin/scripts/setup.php 404 1ms
GET / 200 2ms - 2.65kb
GET /w00tw00t.at.blackhats.romanian.anti-sec:) 404 1ms
GET /phpMyAdmin/scripts/setup.php 404 1ms
GET /phpmyadmin/scripts/setup.php 404 0ms
GET /pma/scripts/setup.php 404 1ms
GET /myadmin/scripts/setup.php 404 1ms
GET /MyAdmin/scripts/setup.php 404 1ms
GET /manager/html 404 2ms

I've been reading about software that makes these types of requests, and it seems to be just an automated tool to find vulnerabilities in the system.

Now, I know that only me and a second person have ever accessed this service, it is not published or mentioned anywhere else but Amazon. I also know that none of us is running vulnerability checking against the application.

So I wanted to know before I raise alarms, am I or this other person infected by malware?

Improve this question
1
  • 1
    If you have to expose your EC2 instance to the entire Internet you should consider making a snapshot of it prior to publishing it. Reboot the snapshot instead of the instance and any headway by attackers will be eliminated. Of course a weak system will probably get re-exploited but your baseline will always be available to reuse/harden.
    – zedman9991
    Commented Aug 15, 2014 at 13:04

1 Answer 1

Reset to default
1

No, this is definitely a scanner trying various URLs on the server to see which URL it can find.

For example, if it finds "/phpmyadmin/scripts/setup.php" it knows you have phpmyadmin installed, and where it's installed. The attacker can then find the version, and run a known exploit to get access.

As for how they found it, it could be several ways:

  1. Amazon has a certain IP block assigned for their use. It's publicly known, so you could just hit each IP address in that block.
  2. You could fuzz urls, using a dictionary of words and a dictionary of TLDs.
  3. Google will have indexed the site, as Google is notified of all domain registrations (as per it's status as a registrar (See here for an illustration of the trouble it cas cause)
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .