Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Today I checked my server's user.log file and it's full of the following Suhoshin messages

suhosin[6842]: ALERT - ASCII-NUL chars not allowed within request variables - dropped variable 'page' (attacker '.....    
suhosin[29033]: ALERT - configured GET variable value length limit exceeded - dropped variable... 

etc.

I see similar messages in user.log file almost every day, but never so many.

My question: Do you have any idea what is the aim of the atacker to send identical post and get requests from many different IP addresses if all such requests are being blocked by Suhoshin?

Requests are coming from ~50 IP addresses (Maxmind says all IPs are Anonymous proxies):

/file.php?fid=%60cat%20/etc/passwd%60 
/file.php?fid=................windowswin.ini
/file.php?fid=../../../../../../../../../../boot.ini
share|improve this question

2 Answers 2

up vote 1 down vote accepted

Seems to be generic botnet attack, which searches for a file.php and hopes to get content from your local file system. Look at the fid string.

As long as you have no such a creepy script you are safe. Believe, there are some scripts out in the net, which don't validate the string and serving the file from server filesystem.

This attack is the same as the bunch of other bot request to find unsecure phpmyadmin installs and stuff.

Especially to the suhosin messages: suhosin is hardening your php installation for common attacks like the Poison NULL Byte Attack (first message). PHP does not use NULL-terminated strings, but the underlying C functions do. The second message indicates an long query parameter, which is dropped. Here it depends is it a random attacker with long query string, or is it your application with long query string and suhosin.get.max_name_length is too small.

share|improve this answer

It's call Fuzzing. These are normally part of a larger attack, which some might call an APT (though I'm not fond of that terminology or the gravity it implies). It's entirely possible that it's just a botnet looking for targets with a particular page, and systematically testing for weaknesses.

What should you do:

  • Make sure all your software is up to date.
  • Make sure you have current backups.
  • If any of the software is custom written, make sure the security is up to snuff. OWASP has excellent security resources for web application developers.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.