1

In looking at my logs, I get many GET requests aimed at a directory with what appear to be auto-index parameters. Stuff like ?C=M or ?O=A. I understand those.

But I also get many requests with ?N=D, ?M=A, ?N=A, ?C=S, ?D=A. I don't have a clue what those mean. Is there some complete list of these commands that describes what they do? On my system, they just throw the requester to my index.html file. What are these requesters trying to do?

http://httpd.apache.org/docs/2.2/mod/mod_autoindex.html just gives a few of them.

Improve this question

1 Answer 1

Reset to default
0

Simple. It is likely hackers are landscaping your site to discover what software you use and ultimately figure out what vulnerabilities exist within your site to take advantage of later. I would block these domain names and IP addresses as quickly as possible. Often, these are systems that have been compromised, proxy servers, or (rarely) a hacker directly and therefore can come from anywhere even sites that look legitimate. Keep in mind that these domain names and IP addresses can change often and there can be several of them. Also know that the hack attempts often do not come from the same domain names or IP addresses. Hackers will landscape then hack later. But depending upon the code, the hack and landscape can come from the same machines. You have to be on your toes.

Improve this answer
4
  • That's a very good point. But how are those auto-index-like parameters going to reveal anything about my software. Is there software that does respond to these commands? I get loads of "pings" and "pokes" that I interpret as site landscaping, but when these IPs come to visit, they only come with these commands.
    – user618
    Feb 27, 2014 at 19:20
  • I should add that there is one IP that does a GET /~account/directory/?M=A repeatedly. Several times a day. That's all he/she/it ever does. As if he/she/it is waiting for something. What might that be? He/she/it is repeatedly served my index.html file, as a result. Not clear what the purpose would be of mowing my lawn several times a day, unless I expect something to happen. That's landscaping that doesn't buy me anything.
    – user618
    Feb 27, 2014 at 19:21
  • Not having a good view of your traffic, I can only comment generically. Often landscaping will try a series of parameters. Some make sense and some do not. Often, the parameter can be tied back to a specific software parameter, but sometimes it is just serial testing to see what parameters have an effect. They know when a parameter has an effect when the results change. This is the equivalent of throwing spaghetti against the wall to see if it sticks. I see very stupid and unfocused query attempts and I see highly focused query attempts. Rarely do I see anything in between.
    – closetnoc
    Feb 27, 2014 at 19:26
  • Okay. This can be a hacker or someone who is operating a spider that has a bad URL. Often rogue spider operators will request the same thing over and over again for stupid reasons. Sometimes rogue spiders are still hackers using the spider to see what resolves. I would say that is it more a rogue spider operator. Hackers will use a spider with varying parameters to sample your site. I would watch this IP address for a while. If this is all they are doing, then it may be harmless but annoying. You can block it or ignore it. But I would watch it for a while just in case.
    – closetnoc
    Feb 27, 2014 at 19:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.