5

Noticing the following in my Apache access logs recently and would like to know what it is about and what is the purpose of printing md5?

"GET /index.php/module/aciton/param1/$%7b@print_r(md5(1123123))%7d HTTP/1.0" 200 14021 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9) Gecko/20080705 Firefox/3.0 Kapiko/3.0"

I'm not concerned about the code 200 response, because all unknown page requests are redirected to the front page of the website. Based on other urls attempted by the same IP address, it appears to be looking for a app or script called zabbix.

  • 1
    "I'm not concerned about the code 200 response, because all unknown page requests are redirected to the front page of the website." - maybe you should be? Redirecting all unknowns to the home page is potentially bad for SEO and users. Has your domain been registered to someone else before? "looking for a app or script called zabbix" - obscure requests like this are often looking for vulnerabilities or maybe, in this case, they are trying to "monitor" your network, since that appears to be the nature of this software? "HTTP/1.0" - That is certainly a (old) bot. – MrWhite Aug 31 '16 at 7:57
1

First of all redirecting all unknown pages to your homepage has the potential to badly affect your SERP ranking as the crawler will see a potentially huge number of pages which don't actually exist as existing and being exact duplicates of your homepage. If a page does not exist on your server according to standard and as is best practice for SEO your server should return a 404 error and whatever 404 error page you have designed or chosen to use for your site.

Now as for the entry in your log the zh-CN in the user agent string would tend to indicate a high likelihood that this is originating from somewhere in China and the Windows NT 5.1 part indicates an extremely old operating system. The nature of the URL string in the log would indicate to me that this is an attempt to penetrate your site based on the assumption that it is powered by one of the popular MVC frameworks as those frameworks tend to use the URL sequence /module/action/param.

Unfortunately there is not a huge amount that can be done to prevent this as attacks of this type are common on the web. As a webmaster you can keep an eye on how often these attacks show up in your server logs, and potentially block the netblock of the offending IP address.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.