1

This afternoon I got a flood of request (400+ within 10 minutes) to one of my web applications, from the same IP address, for non-existent URI.

All of the requests were GET with a path the matches the following format

^((\/[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}){2})\/from\?get\&nocache=[a-z0-9]{5}$

an example of one of the requests

/F834D4AE-7C9D-D641-9AAF-F069F547BC8C/FA4E1A87-5808-B342-BCDE-713371F499F9/from?get&nocache=1d8a4

Are these requests something to be concerned with, what could be generating the requests, and is there something they are trying to do?

4
  • Most probably looking for some kind of known vulnerability. If your site is not susceptible to such a request (ie. it simply generates a 404 and consumes minimal resources) then it's really a non-issue. [A-Z0-9] - GUIDs are hex, which is consistent with the example URL posted. ie. [A-F0-9] (or [A-F\d]). Or you could just match \w (any word character) for a shorter regex and use a quantifier to match 2 x GUIDs. – MrWhite Aug 19 '20 at 15:56
  • thanks @MrWhite for the response and Regex simplification. Since this came from someone that is claiming to want to partner with us, I am a bit hesitant to just trust the 404 I've been responding with. – Tezyn Aug 19 '20 at 17:04
  • "this came from someone that is claiming to want to partner with us" - that's weird! So, you "know" them? Are they perhaps trying to run their own pen-tests on your app before they commit?! – MrWhite Aug 20 '20 at 0:26
  • Ya. I would like to be able to approach them with more than my gut feelings, but can't seem to figure out what they're up to to actually approach them about it. – Tezyn Aug 20 '20 at 1:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.