1

We experienced a strange attack yesterday.

Our error log picked up the same 'out of memory' JavaScript error from a single IP address every 10 seconds. The requests came from 6 client ports on the same IP. Each client port used once per minute requested the same JavaScript file.

What could the attacker be doing? The JavaScript file he requested had 1:1:37408 appended to it. What is the best way to capture the actual requests he is making?

1

Depending on what the attacker is doing capturing the requests he is making may or may not give you any useful information. As for what he is trying to do it is unlikely anyone could give you a useful answer there other than the attacker themselves and anyone attempting to do so would only be giving their opinion. In these situations the only thing you can really do is add a temporary IP ban (say 24-72 hours to begin with) to your .htaccess file. Generally when attackers see something like this happen if your site just happens to be a drive-by attempt at something they will move onto another site and try their luck there, if they are focused on your site for some reason then the IP block will keep it safe for however long you set it for and then when you release the IP block just keep a close watch on his IP and see if you see attacks coming from it again.

With our network of applications online we monitor for attacks to identify potential security related bugs in our code to fix but other than that we don't really care what the attacker is doing, what matters is the fact that they are actually attacking. We use an automated script we wrote in house that detects these hacking attempts, first few times the user will be directed to a warning page that what they are doing appears as a security concern to us and that further attacks will result in action being taken, if the attacks continue 24 hour ip block, after the release if it continues 72 hour block, if after the release it continues again 30 day block, only option after that is a permanent block on the IP and in all circumstances of 24 hours or more we report the IP address to a range of blacklists and partner companies as a dangerous IP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.