Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #6154 > unrolled thread

What is this attack trying to do?

Back to article view | Back to comp.lang.php

Contents

  What is this attack trying to do? The Natural Philosopher <tnp@invalid.invalid> - 2012-05-24 03:22 +0100
    Re: What is this attack trying to do? Robert Heller <heller@deepsoft.com> - 2012-05-23 22:28 -0500
      Re: What is this attack trying to do? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-05-24 13:34 +0200
      Re: What is this attack trying to do? Denis McMahon <denismfmcmahon@gmail.com> - 2012-05-24 14:40 +0000
        Re: What is this attack trying to do? The Natural Philosopher <tnp@invalid.invalid> - 2012-05-24 22:50 +0100
          Re: What is this attack trying to do? Captain Paralytic <paul_lautman@yahoo.com> - 2012-05-30 04:46 -0700
            Re: What is this attack trying to do? The Natural Philosopher <tnp@invalid.invalid> - 2012-05-30 13:20 +0100
              Re: What is this attack trying to do? Robert Heller <heller@deepsoft.com> - 2012-05-30 09:06 -0500
                Re: What is this attack trying to do? The Natural Philosopher <tnp@invalid.invalid> - 2012-05-30 15:28 +0100
                  Re: What is this attack trying to do? Robert Heller <heller@deepsoft.com> - 2012-05-30 12:30 -0500
                    Re: What is this attack trying to do? The Natural Philosopher <tnp@invalid.invalid> - 2012-05-30 22:27 +0100

#6154 — What is this attack trying to do?

GET 
mycode.php?param=-24+UNION+SELECT+0x6d6567613164756d706572,0x6d6567613264756d706572,0x6d6567613364756d706572,0x6d6567613464756d706572,0x6d6567613564756d706572,0x6d6567613664756d706572,0x6d6567613764756d706572,0x6d6567613864756d706572,0x6d6567613964756d706572,0x6d65676131064756d706572

???

It doesn't do any damage but a botnet has been spraying a site with this.

-- 
To people who know nothing, anything is possible.
To people who know too much, it is a sad fact
that they know how little is really possible -
and how hard it is to achieve it.

[toc] | [next] | [standalone]

#6155

At Thu, 24 May 2012 03:22:58 +0100 The Natural Philosopher <tnp@invalid.invalid> wrote:

> 
> GET 
> mycode.php?param=-24+UNION+SELECT+0x6d6567613164756d706572,0x6d6567613264756d706572,0x6d6567613364756d706572,0x6d6567613464756d706572,0x6d6567613564756d706572,0x6d6567613664756d706572,0x6d6567613764756d706572,0x6d6567613864756d706572,0x6d6567613964756d706572,0x6d65676131064756d706572
> 
> ???
> 
> It doesn't do any damage but a botnet has been spraying a site with this.

There is probably some websoftware out there with a mycode.php with some
sort of security hole and the botnet is poking at every web host it can
find looking for a hole to crawl in.  Botnets are not always smart and
sometimes just use 'mindless' brute force and keep pounding until
something gives...

> 

-- 
Robert Heller             -- 978-544-6933 / heller@deepsoft.com
Deepwoods Software        -- http://www.deepsoft.com/
()  ascii ribbon campaign -- against html e-mail
/\  www.asciiribbon.org   -- against proprietary attachments

[toc] | [prev] | [next] | [standalone]

#6161

Robert Heller wrote:

> The Natural Philosopher wrote:
>> GET
>> 
mycode.php?param=-24+UNION+SELECT+0x6d6567613164756d706572,0x6d6567613264756d706572,0x6d6567613364756d706572,0x6d6567613464756d706572,0x6d6567613564756d706572,0x6d6567613664756d706572,0x6d6567613764756d706572,0x6d6567613864756d706572,0x6d6567613964756d706572,0x6d65676131064756d706572
>> 
>> ???
>> 
>> It doesn't do any damage but a botnet has been spraying a site with this.
> 
> There is probably some websoftware out there with a mycode.php with some
> sort of security hole and the botnet is poking at every web host it can
> find looking for a hole to crawl in.  Botnets are not always smart and
> sometimes just use 'mindless' brute force and keep pounding until
> something gives...

The security hole here probably includes a vulnerability to an SQL
injection attack, as the "UNION SELECT" produced from this query part by 
urldecode()d would suggest.  A lot of information about this attack can be 
found via Google, for example when using "0x6d6567613164756d706572" as 
keyword.

<http://php.net/urldecode>


PointedEars
-- 
> If you get a bunch of authors […] that state the same "best practices"
> in any programming language, then you can bet who is wrong or right...
Not with javascript. Nonsense propagates like wildfire in this field.
  -- Richard Cornford, comp.lang.javascript, 2011-11-14

[toc] | [prev] | [next] | [standalone]

#6165

On Wed, 23 May 2012 22:28:33 -0500, Robert Heller wrote:

> There is probably some websoftware out there with a mycode.php 

A quick google suggests that some forum code (myBB) has a mycode.php.

Whether this is the target of the attack or not I have no idea.

Rgds

Denis McMahon

[toc] | [prev] | [next] | [standalone]

#6170

Denis McMahon wrote:
> On Wed, 23 May 2012 22:28:33 -0500, Robert Heller wrote:
> 
>> There is probably some websoftware out there with a mycode.php 
> 
> A quick google suggests that some forum code (myBB) has a mycode.php.
> 
> Whether this is the target of the attack or not I have no idea.
> 
no, because mnycode.php was just and example not what the attack 
actually called.


It called a valid page I had written. I tested the URL supplied and it - 
sent back the default page that happens when it didn't recognise the 
parameter.


> Rgds
> 
> Denis McMahon
> 


-- 
To people who know nothing, anything is possible.
To people who know too much, it is a sad fact
that they know how little is really possible -
and how hard it is to achieve it.

[toc] | [prev] | [next] | [standalone]

#6221

On May 24, 10:50 pm, The Natural Philosopher <t...@invalid.invalid>
wrote:
> Denis McMahon wrote:
> > On Wed, 23 May 2012 22:28:33 -0500, Robert Heller wrote:
>
> >> There is probably some websoftware out there with a mycode.php
>
> > A quick google suggests that some forum code (myBB) has a mycode.php.
>
> > Whether this is the target of the attack or not I have no idea.
>
> no, because mnycode.php was just and example not what the attack
> actually called.
And how were we supposed to know that?

[toc] | [prev] | [next] | [standalone]

#6223

Captain Paralytic wrote:
> On May 24, 10:50 pm, The Natural Philosopher <t...@invalid.invalid>
> wrote:
>> Denis McMahon wrote:
>>> On Wed, 23 May 2012 22:28:33 -0500, Robert Heller wrote:
>>>> There is probably some websoftware out there with a mycode.php
>>> A quick google suggests that some forum code (myBB) has a mycode.php.
>>> Whether this is the target of the attack or not I have no idea.
>> no, because mnycode.php was just and example not what the attack
>> actually called.
> And how were we supposed to know that?

I didn't think it was relevant. It was calling a random php script that 
takes parameters.


-- 
To people who know nothing, anything is possible.
To people who know too much, it is a sad fact
that they know how little is really possible -
and how hard it is to achieve it.

[toc] | [prev] | [next] | [standalone]

#6225

At Wed, 30 May 2012 13:20:10 +0100 The Natural Philosopher <tnp@invalid.invalid> wrote:

> 
> Captain Paralytic wrote:
> > On May 24, 10:50 pm, The Natural Philosopher <t...@invalid.invalid>
> > wrote:
> >> Denis McMahon wrote:
> >>> On Wed, 23 May 2012 22:28:33 -0500, Robert Heller wrote:
> >>>> There is probably some websoftware out there with a mycode.php
> >>> A quick google suggests that some forum code (myBB) has a mycode.php.
> >>> Whether this is the target of the attack or not I have no idea.
> >> no, because mnycode.php was just and example not what the attack
> >> actually called.
> > And how were we supposed to know that?
> 
> I didn't think it was relevant. It was calling a random php script that 
> takes parameters.

I suspect that the cracker botnet 'spiders' web sites looking for links
with URLs that match the RegEx pattern '.*\.php\?.*' and then create
'attack' URLs based on these URLs, but with crafted parameters that
probe for security holes or perform SQL Injections.  The actual PHP
scripts being called are not partitularly relevant.  There might be
some well known PHP scripts or common script elements that have
possible security issues that people are 'recycling' in custom PHP
scripts and these crackers are looking for these scripts with their
botnet 'spiders' and are using a 'brute force' type of attack.
 

> 
> 

-- 
Robert Heller             -- 978-544-6933 / heller@deepsoft.com
Deepwoods Software        -- http://www.deepsoft.com/
()  ascii ribbon campaign -- against html e-mail
/\  www.asciiribbon.org   -- against proprietary attachments


                                                                                     

[toc] | [prev] | [next] | [standalone]

#6226

Robert Heller wrote:
> At Wed, 30 May 2012 13:20:10 +0100 The Natural Philosopher <tnp@invalid.invalid> wrote:
> 
>> Captain Paralytic wrote:
>>> On May 24, 10:50 pm, The Natural Philosopher <t...@invalid.invalid>
>>> wrote:
>>>> Denis McMahon wrote:
>>>>> On Wed, 23 May 2012 22:28:33 -0500, Robert Heller wrote:
>>>>>> There is probably some websoftware out there with a mycode.php
>>>>> A quick google suggests that some forum code (myBB) has a mycode.php.
>>>>> Whether this is the target of the attack or not I have no idea.
>>>> no, because mnycode.php was just and example not what the attack
>>>> actually called.
>>> And how were we supposed to know that?
>> I didn't think it was relevant. It was calling a random php script that 
>> takes parameters.
> 
> I suspect that the cracker botnet 'spiders' web sites looking for links
> with URLs that match the RegEx pattern '.*\.php\?.*' and then create
> 'attack' URLs based on these URLs, but with crafted parameters that
> probe for security holes or perform SQL Injections.  The actual PHP
> scripts being called are not partitularly relevant.  There might be
> some well known PHP scripts or common script elements that have
> possible security issues that people are 'recycling' in custom PHP
> scripts and these crackers are looking for these scripts with their
> botnet 'spiders' and are using a 'brute force' type of attack.
>  
> 
I think that is probably the case.

"well known PHP scripts or common script elements that have
possible security issues that people are 'recycling'"

One good reason to roll your own. There may be bugs and security holes 
but they aren't *well known* bugs and security holes.


>>
> 


-- 
To people who know nothing, anything is possible.
To people who know too much, it is a sad fact
that they know how little is really possible -
and how hard it is to achieve it.

[toc] | [prev] | [next] | [standalone]

#6228

At Wed, 30 May 2012 15:28:33 +0100 The Natural Philosopher <tnp@invalid.invalid> wrote:

> 
> Robert Heller wrote:
> > At Wed, 30 May 2012 13:20:10 +0100 The Natural Philosopher <tnp@invalid.invalid> wrote:
> > 
> >> Captain Paralytic wrote:
> >>> On May 24, 10:50 pm, The Natural Philosopher <t...@invalid.invalid>
> >>> wrote:
> >>>> Denis McMahon wrote:
> >>>>> On Wed, 23 May 2012 22:28:33 -0500, Robert Heller wrote:
> >>>>>> There is probably some websoftware out there with a mycode.php
> >>>>> A quick google suggests that some forum code (myBB) has a mycode.php.
> >>>>> Whether this is the target of the attack or not I have no idea.
> >>>> no, because mnycode.php was just and example not what the attack
> >>>> actually called.
> >>> And how were we supposed to know that?
> >> I didn't think it was relevant. It was calling a random php script that 
> >> takes parameters.
> > 
> > I suspect that the cracker botnet 'spiders' web sites looking for links
> > with URLs that match the RegEx pattern '.*\.php\?.*' and then create
> > 'attack' URLs based on these URLs, but with crafted parameters that
> > probe for security holes or perform SQL Injections.  The actual PHP
> > scripts being called are not partitularly relevant.  There might be
> > some well known PHP scripts or common script elements that have
> > possible security issues that people are 'recycling' in custom PHP
> > scripts and these crackers are looking for these scripts with their
> > botnet 'spiders' and are using a 'brute force' type of attack.
> >  
> > 
> I think that is probably the case.
> 
> "well known PHP scripts or common script elements that have
> possible security issues that people are 'recycling'"
> 
> One good reason to roll your own. There may be bugs and security holes 
> but they aren't *well known* bugs and security holes.

And one should *allways* bulletprof the code.  ALLWAYS sanitize parameters. 
Prefer $_POST[] over $_GET[] where possible or sensible.  Check the
referer where that makes sense. And so on.

> 
> 
> >>
> > 
> 
> 

-- 
Robert Heller             -- 978-544-6933 / heller@deepsoft.com
Deepwoods Software        -- http://www.deepsoft.com/
()  ascii ribbon campaign -- against html e-mail
/\  www.asciiribbon.org   -- against proprietary attachments


                                                                    

[toc] | [prev] | [next] | [standalone]

#6232

Robert Heller wrote:
> At Wed, 30 May 2012 15:28:33 +0100 The Natural Philosopher <tnp@invalid.invalid> wrote:
> 
>> Robert Heller wrote:
>>> At Wed, 30 May 2012 13:20:10 +0100 The Natural Philosopher <tnp@invalid.invalid> wrote:
>>>
>>>> Captain Paralytic wrote:
>>>>> On May 24, 10:50 pm, The Natural Philosopher <t...@invalid.invalid>
>>>>> wrote:
>>>>>> Denis McMahon wrote:
>>>>>>> On Wed, 23 May 2012 22:28:33 -0500, Robert Heller wrote:
>>>>>>>> There is probably some websoftware out there with a mycode.php
>>>>>>> A quick google suggests that some forum code (myBB) has a mycode.php.
>>>>>>> Whether this is the target of the attack or not I have no idea.
>>>>>> no, because mnycode.php was just and example not what the attack
>>>>>> actually called.
>>>>> And how were we supposed to know that?
>>>> I didn't think it was relevant. It was calling a random php script that 
>>>> takes parameters.
>>> I suspect that the cracker botnet 'spiders' web sites looking for links
>>> with URLs that match the RegEx pattern '.*\.php\?.*' and then create
>>> 'attack' URLs based on these URLs, but with crafted parameters that
>>> probe for security holes or perform SQL Injections.  The actual PHP
>>> scripts being called are not partitularly relevant.  There might be
>>> some well known PHP scripts or common script elements that have
>>> possible security issues that people are 'recycling' in custom PHP
>>> scripts and these crackers are looking for these scripts with their
>>> botnet 'spiders' and are using a 'brute force' type of attack.
>>>  
>>>
>> I think that is probably the case.
>>
>> "well known PHP scripts or common script elements that have
>> possible security issues that people are 'recycling'"
>>
>> One good reason to roll your own. There may be bugs and security holes 
>> but they aren't *well known* bugs and security holes.
> 
> And one should *allways* bulletprof the code.  ALLWAYS sanitize parameters. 
> Prefer $_POST[] over $_GET[] where possible or sensible.  Check the
> referer where that makes sense. And so on.
> 
yeah right. As in the case I cited where the ONLY thing it does is 
select from one of 47 possible news items.

You can do a huge amount of damage to a script like that.

>>
>>
> 


-- 
To people who know nothing, anything is possible.
To people who know too much, it is a sad fact
that they know how little is really possible -
and how hard it is to achieve it.

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.php

csiph-web