I had this idea to checkup on my logs for a web server I'm running and see what type of requests
that it was getting. I wasn't planning on writing it any findings up but recovering from my
latest hiking trip. I figure I would do something.
What stood out to me when I was looking at the logs. It was getting hit by spam drive-by
attacks. Some typical basic ones of getting the myAdmin pages and other unsecured servers might
have. Though I found a couple of request that were interesting to me anyways.
SQL in the request header.
The first time this showed up in my logs was May 7th 2019, and coming from China. The url
request from my server is usually a hexadecimal url string. What caught my eye the most was in
the request header there was a SQL like query in there.
554fcae493e564ee0dc75bdf2ebf94caads|a:3:{s:2:"id";s:3:"'/*";s:3:"num";s:141:"*/ union
select 1,0x272F2A,3,4,5,6,7,8,0x7b247b24524345275d3b6469652f2a2a2f286d6435284449524543544f52595f534550415241544f5229293b2f2f7d7d,0--";s:4:"name";s:3:"ads";}554fcae493e564ee0dc75bdf2ebf94ca
I'm not sure what their target was. It looks to me they where looking for a possible a name
with ads.
The server I pulled this from doesn't have any databases hooked up to it so this request wasn't
harmful to me.
Reconnect to my server?
The first time this request showed up in my logs was May 04 2019, and coming from China. The
request has a string of encoded hexadecimal and at the end is http protocol url of server ip
address. Why it caught my eye was that it had server ip in the request url. This one I'm not
sure what is going on with it. I'm going to take a guess that it might be some type of buffer
overflow.
Conclusion
I'm not sure why this are attacks. I did searches on the string to see if anyone was talking
about them. I didn't have any luck. I just wanted to write about because I thought they looked
interesting. I fairly sure that they are coming from an automated script to see if they can get
an easy target, because they do show up in my logs often with other requests from the same
place. Just some of my thoughts on these POST requests.