Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I was recently asked 'What causes a line like this in our access.log?'

59.56.109.181 - - [22/Feb/2010:16:03:35 -0800] "GET http://www.google.com/ HTTP/1.1" 200 295 "-" "Mozilla/5.0 (compatible; MSIE 5.01; Win2000)"

My immediate answer is that's someone exploring something a little devious.

But:

  • how? Speculation... a short perl or python script could easily connect and ask for a URL with an invalid host. but don't post one. If you know a good one liner, I'd be curious. Consider this golf for today :)
  • Vulnerabilities? What is someone looking for when they do this, what have they learned, and should we patch it?
  • Do I need a tin-foil hat to keep them from reading my mind?
  • And for me the real question: Shouldn't that be a 404 response, not a 200!?

This is on a standard LAMP server (Ubuntu).

share|improve this question
    
First question: did you write your entire Apache configuration yourself? Is this a server you've inherited responsibility for? –  PP. Feb 23 '10 at 16:10
    
Co-workers server. Conf mostly comes from default packaging in Ubuntu. It will be a while if you want a conf file... I'm looking in my servers to see if it replicates...ah found some. Since its debian style the conf is split up -- what pieces do you need? –  Paul Feb 23 '10 at 16:19
    
One server this replicates on is a standard VPS at linode. The apache conf is set up for virtual hosting. sites.enabled contains, among other things, a 000-default with a "VirtualHost *:80" declaration. Could that be what lets in requests to google.com ? –  Paul Feb 23 '10 at 16:24
1  
I only ask because there may be some rewrite rules in the configuration somewhere. I would expect that, with a clean install, you wouldn't see the kind of HTTP request you gave with a 200 response. However Apache is extremely configurable and could well re-write such a URL into an acceptable form. –  PP. Feb 23 '10 at 17:26
1  
If you want codegolf - printf 'GET http://www.google.com/ HTTP/1.1\r\n\r\n'|nc yourserver.com 80 –  grawity Feb 23 '10 at 20:25
show 3 more comments

2 Answers 2

up vote 4 down vote accepted

I think this would happen if someone tried to use the server as a proxy. That would make the http://... URL "normal" (as opposed to just the path portion that you would expect from a regular server request.)

As for the 200 status code, that... err.. well, my server does that too. It seems to ignore the http://hostname portion and returns the result from the local server using the remaining path. You'll probably have to dig through the RFCs to figure out why that makes sense; I don't know the answer offhand.

share|improve this answer
add comment

Maybe you want to read http://wiki.apache.org/httpd/ProxyAbuse

specially this point: "My server is properly configured not to proxy, so why is Apache returning a 200 (Success) status code?", it asks your question "Shouldn't that be a 404 response, not a 200!?"

If apache conf is ok, its just sending root page. It's the reason because you get a status code is 200.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.