9

I'm quite sure my server's been hacked. I'm seeing these entries in my access log as the last two before a series of 500 error messages, It's related to the DB but I haven't found out the exact error yet. I'm still trying to figure out what it means - can anyone help me out:

208.90.56.152 - - [16/Jun/2011:16:18:04 +0000] "GET / HTTP/1.1" 200 3011 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

69.162.74.102 - - [16/Jun/2011:16:25:00 +0000] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 315 "-" "-"

Update

OK - on further investigation - for some reason the mysql service was shut down. I restarted it, and everything LOOKS normal. No data's missing, but I'm really not feeling well over the spook of those weird entries - how can I check if someone's been inside my system?

In my MYSQl log I see these lines - how does that realte to what has happened?

Version: '5.0.77'  socket: '/var/lib/mysql/mysql.sock'  port: 3306  Source distribution
110616 17:34:20 [Note] /usr/libexec/mysqld: Normal shutdown

110616 17:34:20  InnoDB: Starting shutdown...
110616 17:34:21  InnoDB: Shutdown completed; log sequence number 0 2054508
110616 17:34:21 [Note] /usr/libexec/mysqld: Shutdown complete

110616 17:34:21  mysqld ended
Improve this question
2

4 Answers 4

Reset to default
17

The DFind scan is just that, a scan, and doesn't indicate a breach; you'll see it all the time if you're watching. See here.

That's a graceful MySQL shutdown, which may warrant further investigation, but isn't terribly suspicious on its own.

Improve this answer
3
  • 5
    More info at seeing w00tw00t in the logs.
    – Cyclops
    Jun 16, 2011 at 22:43
  • thank you for your answer. Do you have any advice on debugging the reason for the mysql shutdown - now I'm a bit worried about why the mysql service just shut down.
    – Jakob
    Jun 16, 2011 at 22:49
  • 3
    To support M. Madden: I've been seeing this and others like it in my server logs for years, and they are not indicative of server compromises. They are the results of idle or malicious people nosing around looking for vulnerabilities. Per RFC 2616 § 14.23, your HTTP server should be treating these requests as erroneous, since they are HTTP 1.1 requests without a Host: header. By the logs posted, it appears that it is (status code 400).
    – JdeBP
    Jun 16, 2011 at 23:17
7

Those two entries in the access log are nothing to worry about.

The first one is perfectly fine (someone at 208.90.56.152 asked for your website root and got it), and the second one looks like someone at 69.162.74.102 tried to access a file called w00tw00t.at.ISC.SANS.DFind:) on your site... and of course didn't find it.

People (or bots) may ask the weirdest things to your web server; this doesn't matter, what matters is that they don't find them :-)

Improve this answer
5
  • so it's just a coincidence that my mysql service went down not long after that request?
    – Jakob
    Jun 16, 2011 at 22:29
  • 2
    I think so. If you look at the time more carefully, you'll also see that MySQL actually went down more than one hour later.
    – Massimo
    Jun 16, 2011 at 22:31
  • Thank you for your response (I can't vote up because I don't have enough cred :)
    – Jakob
    Jun 16, 2011 at 22:49
  • Hi Massimo, what if my website is not public? What if only I know - or supposed to know - the IP/url? In that case it sounds like a malicious attack, isn't it? I received two three requests from 3 IPs: one for "w00tw00t.at.ISC.SANS.DFind" and two for "tmUnblock.cgi".
    – amar
    Oct 8, 2014 at 2:35
  • If the strange request comes from an internal address and you can track it to an internal computer, feel free to investigate it. But it could be infected by some malware, it's not necessarily a deliberate attack by a malicious user.
    – Massimo
    Oct 8, 2014 at 5:41
3

A record of GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1 in your Raw Access logs indicates that someone is running vulnerability scanner which has this fingerprint.

By itself, this entry does not mean that you have been hacked. It only means that someone has been scanning your server for potential vulnerabilities using a web vulnerability scanner. These entries can be followed by other brute-force entries (the actual hack attempts).

This entry should send you a message. Keep your code clean! Most web sites are attacked in one way or another almost every day. Your best defense is to learn what you can do to keep your files, directories, and scripts safe from hackers. Be sure you have your file and directory permissions set properly. Even more importantly, only use safe scripts that have a good reputation for security on the Internet, and be sure that you always check the parent sites for your scripts at least once a month for updates and bug fixes.

Related:

Improve this answer
2
  • You cannot tell from the "400" code whether the hacking attempt was successful. A scan is only the first step of a hack and is carried out to obtain information about your system. Regardless of what response your server decides to send (or whether it cuts the connection), the behaviour informs the next step in the attack. (Of course, if you have a reasonably configured system, the next step usually is to find an easier target.)
    – Joachim Wagner
    Sep 18, 2018 at 12:40
  • Improved the answer
    – kenorb
    Sep 18, 2018 at 13:33
0

As others have mentioned, it's just a scanner. Across a few dozen webservers, I've seen about 15 variations of w00t; probably a few hundred thousands hits over the past year. If it bugs you, just add an Apache directive to deny connections to any client with a w00t UserAgent string. I track this stuff, so I let it hit.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.