6

I assume this is some type of hacking attempt. I've try to Google it but all I get are sites that look like they have been exploited already.

I'm seeing requests to one of my pages that looks like this.

/listMessages.asp?page=8&catid=5+%28200+ok%29+ACCEPTED

The '(200 ok) ACCEPTED' is what is odd. But it does not appear to do anything.

I'm running on IIS 5 and ASP 3.0. Is this "hack" meant for some other type of web server?

Edit:

Normal requests look like:

/listMessages.asp?page=8&catid=5
7
  • 2
    IIS 5 (aka Windows 2000) is fairly old - I assume the server is up to date? I once took over a Windows 2000 IIS server that hadn't been restarted (thus updated) in 700 days. A noble uptime effort, but not so great for security. Mar 17, 2010 at 2:12
  • 4
    Without knowing what kind of requests are normal and valid on your system it's not really possible to give a definitive answer. As for using IIS 5, are you serious? Mar 17, 2010 at 3:09
  • 4
    Ironically/recursively, the google search now lists this question.
    – Kzqai
    Mar 17, 2010 at 3:15
  • 5
    @John: No I'm not serious about IIS 5. I was trying to distract you with incorrect information. I'm not in a position to choose the web server. I just get to maintain it. Mar 22, 2010 at 17:01
  • 5
    @John, When Byran said No I'm not serious about IIS 5. I was trying to distract you with incorrect information he was being sarcastic. He is using IIS 5. Why else would he put that in the question?
    – Josh
    Mar 27, 2010 at 12:48

8 Answers 8

2
  1. May be the log is wrong. It looks like some part of answer inside URL. If it appears in IIS logs, try to watch the request URL using packet sniffer to ensure it is really such.
  2. May be some script gets malformed URL, e.g. it may be bug in your ASP site.

In general it may look like either highly specific or specially crafted crack attempt that is made to look like a bug, but I suppose it is not. You should also analyse previous and further requests from this user. If it is sometimes occur from different places with no other suspicious things, it is a bug, not crack attempts.

2

Are all the requests coming from one IP range? Have you tried running a packet capture to see what the full request headers look like?

1
  • All different IPs. I can see the form & query string values they enter but I have not done any packet capturing. Thanks for the suggestion. Mar 26, 2010 at 17:12
2

Only worthwhile result on Google is this, so ...

Just had this show up on an IIS 6 (Server 2003) site I manage. In this particular case, hitting a ColdFusion page (basic template file which is used across the site, including the home page), and just tacking it on to the end of the URI stem (no query string).

Same request, coming from a number of different IPs, with the following user-agent common amongst them:

Mozilla/3.0 (x86 [en] Windows NT 5.1; Sun)

No referrer information passed. 21 requests over 2 minutes, with a little over half a dozen unique IPs. Countries returned for IP include US, Bosnia, Malaysia, etcetera.

2

I find those entries very interesting (and not in a good way).

/listMessages.asp?page=8&catid=5+%28200+ok%29+ACCEPTED

The basic breakdown of this from a program standpoint gives the following variables:

page = 8
catid = "5 " + chr(28) + "200 ok" + chr(29) + " ACCEPTED"

The catid variable is being corrupted here. ASCII code 28 is File Separator, and code 29 is Group Separator.

If possible, I would check processing of the catid variable, and otherwise ignore it if the program handles it correctly (and rejects it).

2

Here too several attempts during the Easter.

/+%28200+ok%29+ACCEPTED

(200 ok) ACCEPTED

This seems to be random checks against servers.

The IP can be found at the database of Stopforumspam.

http://www.stopforumspam.com/

1

I'm getting the same kind of request on a site running classic ASP on IIS 7. The IP addresses I'm tracing all originate with spammers. I also have no idea what they are trying to do, and it does not affect the site adversely other than to annoy us with 404 errors.

As for 200 OK Accepted, it's an HTTP status code: http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html

1

I don't have sufficient privileges to comment, but I get this as well, with the browser string:

User agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; Alexa Toolbar; (R1 1.5))
IP address: 94.45.33.18

This is against an Apache server. I don't think it's an attack as it's too infrequent and it wouldn't cause a problem on any HTTP server I can think of, except throw 404 errors.

0

Short answer, it may be. But given the information you give us I would say no. More logs could change the answer.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .