3

Every now and then my server logs report that an IP is trying to look for license.txt on two domains. the IP belongs to amazonaws according to a whois lookup.

Is this file supposed to be a new legal file required to comply with world law where its contents describe the rules for my website usage, or does it belong to a special content management system?

The IP wasn't searching for any other files besides license.txt

  • 2
    This is likely a vulnerability test for a web app or a way of stealing license data. AWS is chocked full of bad actors and compromised systems. I would ignore it or have fun with it. For example, you can create a tarpit app that feeds large amounts of data really really slowly. – closetnoc Oct 25 '15 at 4:21
  • 1
    Attempting to find out what version software you are running in an attempt to fingerprint it for vulnerabilities. Common Wordpress/Joomla/Magento, etc. scripted hack scan tactic. Those stupid license files, changelogs and other extraneous litter, don't leave them accessible on a live environment as they leak sensitive information. – Fiasco Labs Oct 25 '15 at 6:38
  • I would remove the file and add any necessary filters to my ban list(s). – Anaksunaman Oct 26 '15 at 0:15
2

Is this file supposed to be a new legal file required to comply with world law where its contents describe the rules for my website usage, or does it belong to a special content management system?

License.txt is simply a generic name for any license file. There is no web "standard" or convention for "license.txt" files like there is for, say, robots.txt or humans.txt. However, many web "applications" (those written in scripting languages, for example) will use a "license.txt" file to convey the terms under which the application is distributed (common to open source projects especially). This file often resides in the root of an application directory.

As pointed out in the comments, retrieval of the "license.txt" file can give various kinds of clues about the system that provides it that may be of use to someone who wishes to exploit the site, even if this information doesn't specifically relate to "license.txt." That said, simply having a "license.txt" file doesn't mean your system is vulnerable.

There is no reason to keep this file available (or any non-essential file after setup for that matter) and it should be removed to discourage bad behavior and thwart any real exploit attempts.

  • 1
    It may not mean that your site is vulnerable, but it does mean that likely hack attempts will come regardless. I have seen this enough to know. Script kiddie scripts do not care too much. – closetnoc Oct 25 '15 at 16:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.