up vote 1 down vote favorite
share [g+] share [fb]

I was recently asked 'What causes a line like this in our access.log?'

59.56.109.181 - - [22/Feb/2010:16:03:35 -0800] "GET http://www.google.com/ HTTP/1.1" 200 295 "-" "Mozilla/5.0 (compatible; MSIE 5.01; Win2000)"

My immediate answer is that's someone exploring something a little devious.

But:

  • how? Speculation... a short perl or python script could easily connect and ask for a URL with an invalid host. but don't post one. If you know a good one liner, I'd be curious. Consider this golf for today :)
  • Vulnerabilities? What is someone looking for when they do this, what have they learned, and should we patch it?
  • Do I need a tin-foil hat to keep them from reading my mind?
  • And for me the real question: Shouldn't that be a 404 response, not a 200!?

This is on a standard LAMP server (Ubuntu).

link|improve this question
First question: did you write your entire Apache configuration yourself? Is this a server you've inherited responsibility for? – PP. Feb 23 '10 at 16:10
Co-workers server. Conf mostly comes from default packaging in Ubuntu. It will be a while if you want a conf file... I'm looking in my servers to see if it replicates...ah found some. Since its debian style the conf is split up -- what pieces do you need? – user33903 Feb 23 '10 at 16:19
One server this replicates on is a standard VPS at linode. The apache conf is set up for virtual hosting. sites.enabled contains, among other things, a 000-default with a "VirtualHost *:80" declaration. Could that be what lets in requests to google.com ? – user33903 Feb 23 '10 at 16:24
1  
I only ask because there may be some rewrite rules in the configuration somewhere. I would expect that, with a clean install, you wouldn't see the kind of HTTP request you gave with a 200 response. However Apache is extremely configurable and could well re-write such a URL into an acceptable form. – PP. Feb 23 '10 at 17:26
1  
If you want codegolf - printf 'GET http://www.google.com/ HTTP/1.1\r\n\r\n'|nc yourserver.com 80 – grawity Feb 23 '10 at 20:25
show 3 more comments
feedback

2 Answers

up vote 2 down vote accepted

I think this would happen if someone tried to use the server as a proxy. That would make the http://... URL "normal" (as opposed to just the path portion that you would expect from a regular server request.)

As for the 200 status code, that... err.. well, my server does that too. It seems to ignore the http://hostname portion and returns the result from the local server using the remaining path. You'll probably have to dig through the RFCs to figure out why that makes sense; I don't know the answer offhand.

link|improve this answer
feedback
up vote 2 down vote

Maybe you want to read http://wiki.apache.org/httpd/ProxyAbuse

specially this point: "My server is properly configured not to proxy, so why is Apache returning a 200 (Success) status code?", it asks your question "Shouldn't that be a 404 response, not a 200!?"

If apache conf is ok, its just sending root page. It's the reason because you get a status code is 200.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.