Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.lang.php > #6161
| Message-ID | <15207571.pMAdyhkN1m@PointedEars.de> (permalink) |
|---|---|
| From | Thomas 'PointedEars' Lahn <PointedEars@web.de> |
| Organization | PointedEars Software (PES) |
| Date | 2012-05-24 13:34 +0200 |
| Subject | Re: What is this attack trying to do? |
| Newsgroups | comp.lang.php |
| References | <jpk622$fas$1@news.albasani.net> <Yt2dnbOpA4J8NyDSnZ2dnUVZ_judnZ2d@posted.localnet> |
| Followup-To | comp.lang.php |
Followups directed to: comp.lang.php
Robert Heller wrote: > The Natural Philosopher wrote: >> GET >> mycode.php?param=-24+UNION+SELECT+0x6d6567613164756d706572,0x6d6567613264756d706572,0x6d6567613364756d706572,0x6d6567613464756d706572,0x6d6567613564756d706572,0x6d6567613664756d706572,0x6d6567613764756d706572,0x6d6567613864756d706572,0x6d6567613964756d706572,0x6d65676131064756d706572 >> >> ??? >> >> It doesn't do any damage but a botnet has been spraying a site with this. > > There is probably some websoftware out there with a mycode.php with some > sort of security hole and the botnet is poking at every web host it can > find looking for a hole to crawl in. Botnets are not always smart and > sometimes just use 'mindless' brute force and keep pounding until > something gives... The security hole here probably includes a vulnerability to an SQL injection attack, as the "UNION SELECT" produced from this query part by urldecode()d would suggest. A lot of information about this attack can be found via Google, for example when using "0x6d6567613164756d706572" as keyword. <http://php.net/urldecode> PointedEars -- > If you get a bunch of authors […] that state the same "best practices" > in any programming language, then you can bet who is wrong or right... Not with javascript. Nonsense propagates like wildfire in this field. -- Richard Cornford, comp.lang.javascript, 2011-11-14
Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
What is this attack trying to do? The Natural Philosopher <tnp@invalid.invalid> - 2012-05-24 03:22 +0100
Re: What is this attack trying to do? Robert Heller <heller@deepsoft.com> - 2012-05-23 22:28 -0500
Re: What is this attack trying to do? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-05-24 13:34 +0200
Re: What is this attack trying to do? Denis McMahon <denismfmcmahon@gmail.com> - 2012-05-24 14:40 +0000
Re: What is this attack trying to do? The Natural Philosopher <tnp@invalid.invalid> - 2012-05-24 22:50 +0100
Re: What is this attack trying to do? Captain Paralytic <paul_lautman@yahoo.com> - 2012-05-30 04:46 -0700
Re: What is this attack trying to do? The Natural Philosopher <tnp@invalid.invalid> - 2012-05-30 13:20 +0100
Re: What is this attack trying to do? Robert Heller <heller@deepsoft.com> - 2012-05-30 09:06 -0500
Re: What is this attack trying to do? The Natural Philosopher <tnp@invalid.invalid> - 2012-05-30 15:28 +0100
Re: What is this attack trying to do? Robert Heller <heller@deepsoft.com> - 2012-05-30 12:30 -0500
Re: What is this attack trying to do? The Natural Philosopher <tnp@invalid.invalid> - 2012-05-30 22:27 +0100
csiph-web