Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My website is throwing up large batches of "Broken link" messages. I assume I'm being probed for a specific vulnerability.

I want to know what the perp is looking for, how they hope it will work, is it coming directly, or from an unwitting victim... all that kind of thing. Anything at all you might be able to tell me about it.

One concern is that there is a spot on the site where users can enter their own HTML which is then presented by our webserver; could this be related to that?

There is about two dozen variations of these:

Referrer: http://210.11.22.33/<script>cross_site_scripting.nasl</script>.jspa
Requested URL: /<script>cross_site_scripting.nasl</script>.jspa

Referrer: http://210.11.22.33/<IMG%20SRC="javascript:alert(cross_site_scripting.nasl);">.jspa
Requested URL: /<IMG SRC="javascript:alert(cross_site_scripting.nasl);">.jspa

Referrer: http://210.11.22.33/<meta%20http-equiv=Set-Cookie%20content=%22testbvny=9424%22>
Requested URL: /<meta http-equiv=Set-Cookie content="testbvny=9424">

Referrer: http://210.11.22.33/<IMG%20SRC="javascript:alert(cross_site_scripting.nasl);">.idc
Requested URL: /<IMG SRC="javascript:alert(cross_site_scripting.nasl);">.idc
share|improve this question

1 Answer 1

up vote 2 down vote accepted

One concern is that there is a spot on the site where users can enter their own HTML which is then presented by our webserver; could this be related to that?

Based upon the URI's requested, this is not related to that.

The attacker appears to be probing your 404 doc to see if he can execute an XSS attack - if you saw this activity on your "return HTML to visitor" URI then you would want to start there, but in this case it doesn't appear as though a valid URI is the target.

Ensure that your 404 page escapes whatever URI is provided and does not allow unescaped HTML through, then take a look at securing your HTML feature if you have not done so already (i.e. by requiring a one-time-use token be posted whenever the feature is used).

share|improve this answer
    
If I understand you correctly they're hoping to gain advantage whereby the requested uri is included in the 404 page, something like: "The page '<insert nasty scripting url here>' could not be found." –  John Mee Nov 2 '10 at 9:57
    
@John_Mee - Yes, that's what it looks like (well documented - see link) - typically this type of attack would be combined with a URL shortener/redirect so the visitor would hit your site and malicious JS runs before the user is aware bad things have happened. Link: google.com/search?q=xss+with+404 –  danlefree Nov 2 '10 at 10:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.