Request “strange”

Tram Ho

If you are a web developer, you must also touch proxy / load balancer or app server. In many operations with this section, regularly checking the log to detect abnormalities is not to be ignored.

Context

Once the website / service is public, it means it has been “exposed” to the internet world. The internet world is like the human world in that “there are people and people everywhere.” That means there are visiting requests for pure purpose, there are also exploratory, destructive requests.

So how do you react to each of these unfriendly requests?

Example # 1

Example # 2

Example # 3

Suppose your domain is https://abc.com , but you receive the following requests:

Details of the above 3 types of log are available at this link

How to fix

If in example # 1 and # 2 the status of the request is 2XX, then it means it is already patched.

In # 3, you telnet to https://abc.com , make GET another external host. If the data returned is data of the external host, it is already open, patch ?

Contact yourself

I have met a pretty sloppy case related to # 3 and Rails as follows:

On the homepage of the web, I have the following cache partial:

And right after I deploy, there is 1 request form # 3 poured, turned my link (*) into:

instead of

Fix it by getting the absolute url to the relative path right away. Soulful.

Look forward to sharing more “strange” log lines from kipaloger.

Ref:

https://wiki.apache.org/httpd/ProxyAbuse

http://www.the-art-of-web.com/system/telnet-http11/

Markdown end here Social share

Note of the author summarizes the article content

  1. Your server can be probed at any time, in different ways.
  2. Knowing if your server has a vulnerability is based on the logs collected.
  3. Exploring doesn’t mean your server has a vulnerability. Ignore it if the log line shows a safe result. On the contrary, fix it right away.

ITZone via kipalog

Share the news now

Source : Kipalog