I was walking through my server logs and the following kinda stunned me:

    Path: /index.php?page=weblog&env=../../../../../../../../etc/passwd%00

    Path: /download.php?dlfilename=../../../../../../../../etc/passwd%00

    Path: /download.php?filename=../../../../../../../../etc/passwd%00

    Path: /agb.php?lang=../../../../../../../../etc/passwd%00

    Path: /angemeldet.php?lang=../../../../../../../../etc/passwd%00

There were lot's more variations, always triyng to get the same file. They wouldn't succeed even if there was some "download.php"*, but I'm curious what would it do if they did.
Also, I wonder if there's something I can do against this BOT in more global scope, to help other webmasters who might have their site vulnerable against such attack.

Unfortunatelly, HTTP headers were not registered.

*I'm running on virtual server where PHP's top dir is the website's root.

1 Answer 1


Ironically, this is exactly the kinds of things I study in my automated security analysis research.

The bot is trying to take advantage of a PHP application vulnerability to read your password file. With success, the hacker would attempt to log into various resources including the PHP application that hosted the vulnerability, as well as, other PHP applications and services such as FTP, SMTP, SSH, etc.

You can either block the ip address and/or domain name, use a regex in your .htaccess file, or (preferred) use mod_security to block these attempts.

Mod_Security is preferred since it covers a multitude of attacks. http://www.modsecurity.org/

This is likely a compromised system that was hacked in the same way. It is likely executing a script or executable and may hit may sites before long. I do not have and attacks from this IP address in my database so it is likely new.

IP: / Netdiscounter GmbH autonomous system - Domain Name: 441.hosttech.eu

I have other PHP application vulnerability hack attempt entries for:

190.hosttech.eu [ip:, asn: AS9044, BSE Software GmbH] (Sun Aug 19 2012)

sh-501.premium.hosttech.eu [ip:, asn: AS24940, Hetzner Online AG] (Thu Jun 6 2013)

  • I just had an attack: --- A user with IP address has been locked out from the signing in or using the password recovery form for the following reason: Exceeded the maximum number of login failures which is: 20. The last username theytried to sign in with was: 'admin' User IP: User hostname: bzq-79-182-60-204.red.bezeqint.net --- I contacted bezeqint.net, but the mailbox there was full. Is this IP in your database?
    – Leo
    Jun 14, 2014 at 1:40
  • @Leo bzq-79-182-60-204.red.bezeqint.net is not in my database, but there are 284 just like it! This is a well known network for abuses. For what it is worth, my website has cut and paste .htaccess block code that can help. My site is being revamped and expanded rapidly, so it is not as pretty as I would like, but it is functional! In fact, I am adding at least 50k domain names and IP addresses and at least 5 more major subject areas.
    – closetnoc
    Jun 14, 2014 at 2:08
  • I get a lot of "Restricted" when trying to view your site. I just looked for a way to contact you here, but I can't find any. Perhaps you can contact me? (I have no idea how this works here on StackExchange.)
    – Leo
    Jun 14, 2014 at 11:09
  • @Leo My bad!! I am having trouble with the decay algorithm and went back to a static number for a bit while I restructure the decay method. I just set the static number too high I guess. The primary reason for this site is experimentation. I set the static number quite a bit lower. In this case, it is all about access speed. It is a matter of click speed and page request speed. There is more, but not for browsers. Sorry for the problem!
    – closetnoc
    Jun 15, 2014 at 0:53
  • Thanks @closetnoc, now I can read your site (after deleting cookies etc).
    – Leo
    Jun 15, 2014 at 2:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.