3

I have found various 404 errors in my web server log that look like this:

http://mywebsite.com/go.php?http://pastebin.com/raw.php?i=ffdkafkjasd
http://mywebsite.com/go?http://pastebin.com/raw.php?i=ffdkafkjasd
http://mywebsite.com/raw.php?http://pastebin.com/raw.php?i=ffdkafkjasd

None of these URLs have ever existed (my website is not even PHP-based). It looks like someone is attempting to guess a URL for a page on my website which causes a browser redirect to pastebin.com.

What is this person trying to do? Is it some sort of attempted hack?

2
  • Apart from an awkward automated blind injection attack, I can not see something else.
    – user45139
    Commented Aug 11, 2015 at 8:41
  • Is this an attempted cross-site attack? NO Commented Jun 21, 2019 at 5:47

1 Answer 1

2

A script or bot is probably probing for an Unvalidated Redirects and Forwards vulnerability.

The reason I say this over SSRF is because the target domain is pastbin.com, and not a domain under control of the attacker. The attacker will have no way of knowing if a SSRF attack worked without validating that the server-side request was made, therefore this is unlikely.

However, with Unvalidated Redirects and Forwards the attacker just needs to look for a redirect HTTP response such as 301 Permanent. If successful, they could then use your site in a phishing style attack using an obfuscated redirect domain (say percent encoded) in the hope their victim follows the link to your (trusted) domain.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .