3

I have found various 404 errors in my web server log that look like this:

http://mywebsite.com/go.php?http://pastebin.com/raw.php?i=ffdkafkjasd
http://mywebsite.com/go?http://pastebin.com/raw.php?i=ffdkafkjasd
http://mywebsite.com/raw.php?http://pastebin.com/raw.php?i=ffdkafkjasd

None of these URLs have ever existed (my website is not even PHP-based). It looks like someone is attempting to guess a URL for a page on my website which causes a browser redirect to pastebin.com.

What is this person trying to do? Is it some sort of attempted hack?

  • Apart from an awkward automated blind injection attack, I can not see something else. – user45139 Aug 11 '15 at 8:41
  • Is this an attempted cross-site attack? NO – I am the Most Stupid Person Jun 21 at 5:47
2

A script or bot is probably probing for an Unvalidated Redirects and Forwards vulnerability.

The reason I say this over SSRF is because the target domain is pastbin.com, and not a domain under control of the attacker. The attacker will have no way of knowing if a SSRF attack worked without validating that the server-side request was made, therefore this is unlikely.

However, with Unvalidated Redirects and Forwards the attacker just needs to look for a redirect HTTP response such as 301 Permanent. If successful, they could then use your site in a phishing style attack using an obfuscated redirect domain (say percent encoded) in the hope their victim follows the link to your (trusted) domain.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.