3

In my server log, I found at least one IP address to be requesting a full URL in an awkward place. For example, the header the client sends to my server is this:

GET http://www.3rdpartysite.com/file.php HTTP/1.1

And here, I'm expecting request headers to be more like this:

GET /path/to/file.php HTTP/1.1
Host: example.com

This makes me think hackers are trying to break my website, but then I look here at http://www.w3.org/Protocols/rfc2616/rfc2616-sec5.html and it talks about that first GET request being valid for proxies.

My server has cpanel and whm installed but I don't use proxies for my website. My question then is, if I force apache to return an error or redirect to all HTTP request headers beginning with...

GET http://

...and I request remote systems to issue headers in this format....

GET /path/to/resource HTTP/x.x
Host: example.com

would my idea work with all web browsers? or would at least one legit web browser break?

I just have a feeling some hacker is using my server to connect to another.

Improve this question
1
  • 2
    This is very likely a poorly coded bot. This has been happening since the beginning of time. I get these almost every day several times a day. Ignore it or block it depending on how pervasive it is.
    – closetnoc
    Dec 5, 2015 at 22:47

2 Answers 2

Reset to default
1

The HTTP 1.1 spec is very clear that

GET /path/to/resource HTTP/1.1
Host: example.com

and

GET http://example.com/path/to/resource HTTP/1.1

are equivalent requests. This is because the request starts with Request-Line which is defined as Method-Token Request-URI Protocol-Version and the Request-URI can be absolute: "*" | absoluteURI | abs_path | authority.

You should not try to configure your web server to respond differently to the different formats of requests. You would be breaking the spec. While browsers today typically use the former request format, there is no guarantee that they will continue to do so in the future. You don't want your website to suddenly stop working with the latest version of some browser.

You should instead ensure that your server does not serve content for unknown hosts. A request for any third party site should return a 404 not found (or possibly even 400 bad request). Bots that request third party sites are typically testing for open proxy servers.

One way to configure your web server to do so is to configure the first (default) virtual host to return a 404 page. Every legitimate site would be in a later virtual host directive.

Improve this answer
0

These happen all the time. I see this at least a dozen times a day in my server logs. Best bet is to block the connection from coming in at the firewall or gateway and that way it doesn't hit your server, otherwise if it isn't a big deal for you and isn't causing you too many hassles and you aren't seeing other errors in relation to this connection then you can pretty safely ignore it.

Improve this answer
3
  • Not sure how much I'll go with the blocking idea because if I block the IP and then a legit user later uses the same IP, then I'll be shooting myself in the foot, especially if that legit user wants to click an adsense ad on my site.
    – Mike -- No longer here
    Apr 15, 2016 at 4:11
  • IP blocks should never be done permenantely, the idea is to make any attacker give up on a specific IP when they realise that they have been blocked from it. Admittedly we use an internal software system to automate many of these processes but what we do is when something like this has been flagged the software takes the following actions. 1. Blocks the IP at the firewall for 24 hours 2. Looks up the IP to get the contact information for the ISP 3. Sends an automatic email to the ISP advising them that the IP address has been used in an attack on our sites.
    – Chris Rutherfurd
    Apr 15, 2016 at 4:13
  • Repeat offences result in longer bans, IE: 24 hours, then 48 hours, then 1 week. By the third instance, with notices being sent to the ISP in question each time we tend to see that if an attack like this has progressed up to the 1 week time frame it no longer happens after that as that final instance we also send notices to a number of blacklists regarding the IP which no ISP wants to see happen and many ISP's monitor for. Gets action taken pretty quick after that.
    – Chris Rutherfurd
    Apr 15, 2016 at 4:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.