2

I've been seeing lots of entries in my 404 error page lists in my shared hosting account, which are attempts to hit sub URLs on my 'static' website, such as (usually with no referring URL):

/\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd%20website.rar
/aspweb.rar
/520.rar
/install.tar.gz
/sql.bak
/a.rar
/web123.zip
/aspweb.zip
/wwwroot.tar

These are aside from the usual attempts on /wp-login.php, etc...

I'm wondering if anyone can explain the above, is it just hacking attempts, should I be worried or ignore them? The site is going through CloudFlare over HTTPS.

|improve this question
  • By 404 error page lists, do you mean your sever's error log, Webmaster Tools/Search Console, or something else? – dan♦ Apr 18 '16 at 4:26
  • 1
    those are attackers checking if the file exists. it there are no such files, its not a big problem. though cloudflare should block those requests. – miyuru Apr 18 '16 at 4:34
  • @dan error pages appearing in my CPanel stats as being accessed and not available – zod Apr 18 '16 at 4:35
  • I did a quick search just in case. I found nothing unusual. These are landscaping attempts looking for backup and/or install files. Nothing to worry about but plenty to block. It is a hacker looking for vulnerabilities by fingerprinting your server installs. – closetnoc Apr 18 '16 at 4:48
  • @closetnoc there are also a number of executable's in my list with pretty strange prefixes such as '/\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd' are they a problem? – zod Apr 18 '16 at 5:01
2

All of these files which are being checked for including the /\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd which you mention in your last comment are attempts by attackers to identify common files which can be vulnerable in your web root which on a mis-configured website can provide an attacker the information they need to penetrate your site.

As an example sql.bak is a standard SQL backup file which an attacker can use to access your entire database as of the last backup if they can get it. aspweb.zip and the other similar files are commonly used by webmasters to package the site and upload it in a compressed file and then uncompress on the server, often leaving behind the compressed file. If an attacker got their hands on this file they would have a complete copy of your site source code if you used this method.

All of these log entries indicate attack attempts on your site which is common and can occur on any site. Definately attempt to block these connections from connecting to your site at all to add an extra level of protection to your site but don't assume the block will be 100% as no block is 100% as the attackers can find their way around it. Do a security audit on your site and make sure that vulnerabilities have been patched and that files such as these can not be accessed and if they must be on the server are not located in the web root.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.