118
The short answer is that many people are scanning everything most of the time.
Doing so was, some years back, considered impractical, but the combination of better networks, better tools better throughput, and more of the space being in use means that is no longer the case.
For example, Zmap claims on its front page:
ZMap is capable of performing a ...
33
These types of spurious requests are very, very common. They are either looking to see if you are already compromised, or looking to get your server to throw an error to gather info about your server (from error messages).
You aren't the only one:
http://shadow.wolvesincalifornia.org/awstats/data/awstats092014.shadow.wolvesincalifornia.org.txt
# URL with ...
14
This seems like it is just random scanners on the internet. They just roam around trying different IP adresses and looking for certain folders and files that might indicate vulnerabilities.
12
I've solved it by generating a fake certificate that doesn't reveal domain name and adding it as a default one on the start of the config:
server {
listen 443 default;
server_name _;
ssl on;
ssl_certificate /path/to/fake.crt;
ssl_certificate_key /path/to/fake.key;
return 403;
}
And yes, it requires a nginx with ...
12
The attacker tries to find out if you have certain premade web software installed by requesting files which are typical for them.
When they find out you use, say, wordpress or phpbb or mediawiki, they can then try to use exploits specific to these applications to take over your site.
The best countermeasure against this is to avoid installing too much ...
11
Unless you have an expert in computer forensics it's gonna be very difficult to know what happened, what files were modified, and what kinds of backdoors were installed.
Since your web server is "huge" I assume you're following a good backup policy, right? Right? Once you have a breach, assume the server is compromised and restore to the most recent good ...
10
Yes, those are scans.
If you Google those strings you will see that they show up in the web logs of numerous sites throughout the Internet, usually cheap webhost sites which put their logs up where Google can see them. This is sufficient indication that some tool is trolling for that URL.
There is not enough information to indicate what the scan is ...
10
I actually went ahead and checked out your challenge and noticed that it required the cookie fusion_user for loading up the challenge. This can be confirmed from the BurpSuite Screenshot I have posted below:
Hence when scanning using nikto we will have to send across this cookie along with the requests.
There are two ways that I know of to do this.
Method ...
9
Due to the nature of how SSL works, the SSL/TLS handshake is performed before the intended hostname is given to the web server. This means that the default (first) certificate is used when trying to access the site, regardless of the domain name used.
This is true with both Apache and nginx.
From the Apache Wiki:
As a rule, it is impossible to host ...
7
It is the ONLY way to be sure.
7
They can't snoop your traffic unless they are in a position of adjacency to any system in the routing chain.
When a client first connects to a server, the packet will go from their computer to their router, which then passes it on to the ISP's local routing server, which then passes it down a backbone (via a set of other large routers) and eventually to the ...
7
That is the correct behavior. In the case of client-side JavaScript, it is by design that the script source is sent to the client to be executed. So, the fact that you can manually browse to the URL for the script file is irrelevant. It gives you no more access than the application intends for you to have.
A source-code disclosure vulnerability is when ...
6
You could compare the Last-Modified HTTP headers for some static resources (e.g images, css), from each IP, and see whether they are different. If they are different I would assume the IPs are separate hosts.
You could also make a request to both IPs at the exact same moment and compare the Date HTTP header in the responses - if they are different then the ...
6
The problem is with the browser (or in the case of the linked CVE with Outlook).
The attack is as follows:
I create a file and send this file to the program with the MIME type image/png.
The browser ignores the MIME type and sniffs the content of the file (even I explicitly say that the file is of type image/png).
The browser determines (from sniffing) ...
6
Is your system publicly accessible?
Yes: Someone is probably scanning it.
No: Are you scanning the server?
Yes: Well, you've just answered your own question now haven't you?
No: It's probably not getting scanned.
I don't know: Wait... what?
I don't know: You've got bigger problems. And yes, you're probably getting scanned.
6
Yes, all your assumptions are correct there.
As you are including content from addthis.com, your client-side Origin is fully trusting this domain. If there was any compromise to addthis.com, or if addthis.com decided to change the script to do something more invasive then your site would be vulnerable.
For example, addthis.com may suddenly decide they want ...
6
Configure your browser to point to Burp's proxy details (e.g. 127.0.0.1:8080) and then configure Burp to use an upstream HTTP proxy for all target hosts (* as the destination):
However, if the upstream proxy is SOCKS, not HTTP, you need to configure it underneath (under the SOCKS Proxy heading) instead. This causes everything to be fed through the proxy. At ...
6
The truth is, any server with a public IP address connected to the internet will be scanned all the time. There are so many automated tools and scanners out there just looking for the low hanging, outdated, easily vulnerable servers.
You are looking for how to secure it, and that is a really important first step. You can not stop the scans. However, that ...
5
There is no magic test for testing for sql injection. Some applications may be vulnerable when using a certain approach and others when using another.
There is a chance that http://example.com/kb/8'/41 would not work because apostrophes are blocked by an IPS, but http://example.com/kb/7%2B/41 would display the same result as http://example.com/kb/8/41 and ...
5
You can do some automated scans with OWASP ZAP or Burp (Burp isn't free).
5
If I understand you want to deny HTTP-Requests, which don't contain a Host header, even if these requests are inside a SSL connection (e.g. https-Requests). These are old-style HTTP/1.0 requests, HTTP/1.1 requires a Host header but also most HTTP/1.0 clients already send one. Blocking these clients can be done with:
if ( $http_host = '' ) {
...
5
Those log entries look like normal scanning activity.
You can also notice that the scanner did not target your setup specifically, because multiple versions and directories are tried. And as you said, none of those actually exist in your setup.
What I don't understand is, why does he use // rather than /
That's likely a bug in their scanning software (...
5
The idea of fuzzing is to send data to the interface with not much intelligence: garbage, random input and so on. When you are using a vulnerability scanner, you usually test for well known problems. In the case of web applications: injections and so on. It is possible that a vulnerability scanner can include some sort of fuzzing as one of the tests it ...
4
Reliably detecting Cross-Site Scripting is a relatively complex task, just inserting a string with no control characters and looking for it in the response, is a very bad idea as you'll be swamped by false positives.
What most scanners to is take a series of standard vectors (e.g. ">< script >alert(1)< /script ><") and then look at the response ...
4
In my opinion, the main problem when a pentester faces a web application that uses clean URLs is to identify which parts of the URL are resources and which parts are parameters because usually parameters are what we test more deeply.
In this case, I think that the best option is to test all parts of the URLs assuming all parts are parameters:
http://...
4
In terms of scanning the system for compliance, it's a question of running vulnerability scans and see if they pass externally and if the risk is acceptable internally. In terms of whether the system is configured in a compliant manner takes more work as per the following list:
Is networking limited to protocols required for business purposes with no ...
4
Since all the requests fail with the "404 Not Found" status, try to create a custom 404 error page that will log everything (all headers, the request, the user's session) and debug this, see if the actual requests come from just a few users with a busted web browser (virus, trojan etc. on the client machine), from all the users, just from users that are ...
4
These requests are caused by Adware:Win32/Adpeak malfunctioning (yeah, believe it or not, even malware can malfunction).
It sets up a proxy server on the infected systems that injects script tags in all HTML content that passes through it, similar to
<script type="text/javascript" id="2f2a695a6afce2c2d833c706cd677a8e" src="http://d.lqw.me/xuiow/?g=...
Only top voted, non community-wiki answers of a minimum length are eligible
