0

in one of my websites I am logging all url requests made to the server. I log that data for stats purpose to improve the website.

The logs look like

http://example.com/search       2016-01-12 23:03:09
http://example.com/post/1234    2016-01-12 23:03:12
..........

So, that looks normal. I've now spotted in the logs something that doesn't make sense to me, I have few hundreds entries with a different domain

http://dhg.example.org/httptest.php   2016-01-10 20:12:15

And in the past I had a few similar to that, with my domain or with the server IP address

http://example.com/httptest.php
http://192.0.123.12/httptest.php

I was wondering how is that possible that requests made to my server have that url and not my website url or server IP.

Should I be worried? Is that some kind of attack to my server?

Edit

To be specific, the app that's running on the server is logging those urls, not the server per se. So on each page request my script is logging the url in the $_SERVER array

2 Answers 2

3

When you say the value from $_SERVER is being used, presumably you mean $_SERVER['HTTP_HOST'].

It's quite easy to set this value to any value-- it comes from the HTTP 'Host: ' header sent in a request your server. For example, where the IP of your server is 1.2.3.4:

curl -H 'Host: otherserver.com' http://1.2.3.4/httptest.php

Your logging system may re-assemble that as appearing to be a request for http://otherserver.com/httptest.php.

Try a request like that on your web server and see what happens in your logs!

I can only guess why someone might do that. People might like to test the HTTP services running on IP address, but don't know any of the valid host names there. Some web servers might reject requests with no 'Host:', header, so sending /some/ 'Host:' header may be better than none.

Also, sometimes malicious URLs seem to be sent to servers just so that they end up in the logs, where a server administrator might see the URLs and possibly click on them.

A good security practice is to drop connections made to the default server{} block in Nginx. This is where connections made with a missing or invalid Host: header go. Here's an example:

server {
    listen       80  default_server;
    server_name  _; # some invalid name that won't match anything
    return       444;
}

The 444 response code is Nginx specific. It simply closes the connection and returns nothing, minimizing the bandwidth and resource use you spend on these connections.

3
  • That makes absolutely sense, thank you! Is there a way to avoid that kind of requests?
    – peppeocchi
    Jan 21, 2016 at 2:28
  • 1
    @peppeocchi I updated my answer to answer your follow-up question as well. You can't stop people from making the requests, but you can mitigate their effects by dropping the requests. Jan 21, 2016 at 15:03
  • thanks for the answer! That's just what I was looking for.
    – peppeocchi
    Jan 22, 2016 at 8:56
0

The first step in a successful attack is information gathering. I did a little research and found that httptest.php is referenced on a github account for something called Kohana, searching for Kohana leads me to a Swift implementation. However someone could be using the same name for the file to try and confuse the log reader. Although a single entree can be just as dangerous when produced by the right person you want to be very diligent about when you see multiple entrees and especially 404 errors in large numbers as this can show clear intent against your network, a single item might just represent someone tried a new exploit which failed and they moved on.

3
  • I am logging the url that you see in your browser bar when you are on my website (actually is the content of $_SERVER), I don't understand how is that event possible that going to that url causes a redirection to my server, that my server redirects to the website app that's bind to a single domain, and that the website replies to that request logging the url. It feels like someone is navigating to my website with a valid url and the $_SERVER array value is being hacked, showing that url instead of the url you see in the browser. It just doesn't make any sense to me
    – peppeocchi
    Jan 20, 2016 at 13:42
  • It feels like I am missing something.... Can be possible that if a user navigates the website through a proxy or tor network, or some other anonymous tool, that's what I get in the $_SERVER?
    – peppeocchi
    Jan 20, 2016 at 13:50
  • those unknown domains could have used (and can still be using) the public IP address your site actually has, and someone is probing that old site for security breaches — that's common, and not to worry unless you do have that same script with some actual vulnerability :)
    – Capilé
    Jan 20, 2016 at 18:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .