A malicious user has been trying to browse to strange URLs that don't exist on my server. One such request turned out to be url encoding:


This urldecoded to:

-d allow_url_include=on -d safe_mode=off -d suhosin.simulation=on -d disable_functions="" -d open_basedir=none -d auto_prepend_file=php://input -d cgi.force_redirect=0 -d cgi.redirect_status_env=0 -n

This next one seems to be requesting an image

"J\x00\x00\x00&8B\x81\x90=Ve\xBE\x0C:\x8B7 m\xD8x\x8Eo\x83\xA9\x8D\xEB{'\xD8\x1A\xF0j\xB2\x95Mu}\x13\x5C\xB5\xAFe\xCD\xC6\xE7&N\xBA\x0B\xF1\xFB\xDCcD\x17\xCA]{H\x8AY\x90M\x04\xC5G\x83g\xF6\xB0U\xC2\xDEj\xE2\xE8n" 400 181 "-" "-"

What is this malicious user trying to do? This is a Ubuntu 14.04 server running nginx to serve up a django application.

  • -d auto_prepend_file=php://input if that worked the raw post body (would have been a post request) would run as php code. – AD7six Sep 12 '15 at 12:49
  • I'd block that IP and call it a day... – alexus Sep 12 '15 at 13:05
  • I blocked it, the attacker goes through a different proxy each time though so it's an ongoing threat. – Benjamin Pinkert Sep 12 '15 at 13:08
  • How might I disallow these types of requests? All of this is on top of constant brute-force ssh auth attempts – Benjamin Pinkert Sep 12 '15 at 13:09
  • some security hints here. – meuh Sep 12 '15 at 13:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.