Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

In 30 min I received over 300 error emails from my app which stated the below request was coming from the same IP, someone was hitting my server with urls like this:

http://mywebsite.com:80/base_local_rules.php?dir=<script>alert('base_local_rules_xss.nasl-1306117559')</script>
http://mywebsite.com/search=<script>alert('XSS')</script>

I understand what's happening in the second attempt, can anyone explain the first?

share|improve this question

migrated from stackoverflow.com May 23 '11 at 3:16

This question came from our site for professional and enthusiast programmers.

    
The first is the same type attack as the second –  MMavipc May 23 '11 at 2:56
1  
Looks like someone is trying to inject script. You should make double sure you are validating all input. Do not trust any input. –  Brian Lyttle May 23 '11 at 2:57
    
A google search turned up nessus.org/plugins/index.php?view=single&id=42264 relating to the "base_local_rules_xss" item. –  Brian Lyttle May 23 '11 at 2:59

1 Answer 1

up vote 0 down vote accepted

This looks like a nessus scan of your domain. Is the source IP by any chance within your service provider's network? It's entirely possible that they scan all their servers with nessus, in order to detect exploited or otherwise broken machines.

It's also entirely possible this is someone trying to attack your site.

share|improve this answer
    
The ip address I get almost looks like a lan address, trying to find information on where it originated comes up with nothing. –  The Muffin Man May 23 '11 at 4:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.