Morning all,


I see a lot of /8398743dhdshjsd/nonexistentfile.php requests in my
Apache log, returned with 404 since the file doesn't exist.

What are people trying to do? Do they try to trigger a bug in php or
are they looking for some misconfigured forum?


Thanks


Patrick

Patrick Ale wrote:
> Morning all,
>
>
> I see a lot of /8398743dhdshjsd/nonexistentfile.php requests in my
> Apache log, returned with 404 since the file doesn't exist.
>
> What are people trying to do? Do they try to trigger a bug in php or
> are they looking for some misconfigured forum?

I believe that it's an attempt to see if mod_rewrite is enabled in conjunction
with php. maybe with regard to A specific piece of software.

you're not the only one who has this in their logs - something google
could have told you:

http://www.google.nl/search?q=nonexistentfile.php

>
>
> Thanks
>
>
> Patrick
>

On 3/20/07, Jochem Maas <EMAIL REMOVED> wrote:
> Patrick Ale wrote:
> > Morning all,>
> you're not the only one who has this in their logs - something google
> could have told you:
>
> http://www.google.nl/search?q=nonexistentfile.php

Hoi Jochem

I did try that on google actually, as you've seen yourself there are
lots of results return, and I actually took the efford of reading the
first 20 links mentioned, and only one mentioned the mod_rewrite, the
others just say how "you've been hacked" , "my server hangs, ack ack
what can I do" and all.

Which is why I asked here

Thanks for your answer, it's well appriciated

MvG / With kind regards,


Patrick

Patrick Ale wrote:
> On 3/20/07, Jochem Maas <EMAIL REMOVED> wrote:
>> Patrick Ale wrote:
>> > Morning all,>
>> you're not the only one who has this in their logs - something google
>> could have told you:
>>
>> http://www.google.nl/search?q=nonexistentfile.php
>
> Hoi Jochem
>
> I did try that on google actually, as you've seen yourself there are

it's always worthwhile to mention that you've already done a search,
it'll usually save you the pain of some a$$hole telling you to STFW ;-)

> lots of results return, and I actually took the efford of reading the
> first 20 links mentioned, and only one mentioned the mod_rewrite, the
> others just say how "you've been hacked" , "my server hangs, ack ack
> what can I do" and all.

well it's definitely an attempt to gain access, cause a buffer overflow or something similiar.
but unless you see anything else strange (load, connections, missing data, defaced pages, etc)
on your server (other than crap in the logs)
then the chances are it was just an attempt that failed.

>
> Which is why I asked here
>
> Thanks for your answer, it's well appriciated
>
> MvG / With kind regards,
>
>
> Patrick

On Tue, March 20, 2007 3:40 am, Patrick Ale wrote:
> I see a lot of /8398743dhdshjsd/nonexistentfile.php requests in my
> Apache log, returned with 404 since the file doesn't exist.
>
> What are people trying to do? Do they try to trigger a bug in php or
> are they looking for some misconfigured forum?

Could be searching for targets of XSS att via:
<form action="<?php echo $_SERVER['PHP_SELF']?>" ...

Use:
<form action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>" ...

Or just hard-code the dang thing, if you never move your forms. :-v

--
Some people have a "gift" link here.
Know what I want?
I want you to buy a CD from some starving artist.
http://cdbaby.com/browse/from/lynch
Yeah, I get a buck. So?