0

I recently got a strange request to my website:

68.192.21.94 - admin [24/Nov/2020:09:51:05 -0500] "POST /doLogin HTTP/1.1" 404 4973 "-" "Abcd"

Somehow a malicous bot got the text "admin" to appear next to the timestamp. How is this possible? From my experience with Apache, the timestamp was provided by the server, not the client.

1 Answer 1

0

The third field in Combined log format is the username given in the HTTP Basic Authentication header. If there is no HTTP authentication header in the request, the field will be -.

So, the bot user simply tried HTTP authentication with admin username and probably a password from dictionary.

You can read more information on HTTP Authentication at Wikipedia

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.