Jan, On Tue, Mar 31, 2009 at 11:30 AM, Jan G.B. <ro0ot.w...@googlemail.com> wrote: > Hi there, > > I've noticed that some weird requests are showing up in the error logs > of one of my apache webservers. > The requests seem to have the following in common: > > * GET Request on some random alphanumeric string like "GET /hDMe9NS"
w3af [0] uses these types of requests to identify the 404 response of a web application. Maybe its somebody using w3af to scan your website? Are you seeing a lot of requests coming from the same IP address after the "random" request? > * Referer has some randomized, invalid URL like > http://www.kSJn32.com/ckJMSC/kSMSR/mndm/sads.html w3af [0] doesn't perform requests with invalid referers; at least not in the original version. Someone could have modified it to behave like this. > Every domain that showed up wasn't registered - no DNS reply or whatsoever. > > > Here's an example out of my Log file ( I slightly modified the random > strings - just in case ;)) > > [Tue Mar 30 10:12:41 2009] [error] [client 124.236.*.*] File does not > exist: /var/www/foo.bar/web/hFBeX7EK, referer: > http://www.ruyidqpg.com/SJQubgQP/QenlI/_n2Pn/_px/Uph/wSBf_l/leJB/C8Y00EIPfD07U/AO8lnzhgAl/SD70gA8Jg/nfA013J/ZOWAgYCZ/DOf7hg.html How does the corresponding entry in the access.log file look like? It should show you some user agent... To find this just: grep hFBeX7EK access.log > The amount of random directories isn't constant. > > Any Ideas what is causing these requests? Is it a well known worm? > What could it be.. what for..? > The Server is Running Apache with PHP, the main application is made > with the symfony framework. > > Thanks, Regards > > > > PS: You believe this doesn't belong into this mailing list? Sorry, I'm > not interested - keep it to yourself. > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > [0] http://w3af.sf.net/ Cheers, -- Andrés Riancho http://www.bonsai-sec.com/ http://w3af.sourceforge.net/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
