21

During the last weekend some of my sites logged errors implying wrong usage of our URLs:

...news.php?lang=EN&id=23'A=0

or

...news.php?lang=EN&id=23'0=A

instead of

...news.php?lang=EN&id=23

I found only one page originally which mentioned this (https://forums.adobe.com/thread/1973913) where they speculated that the additional query string comes from GoogleBot or an encoding error.

I recently changed my sites to use PDO instead of mysql_*. Maybe this change caused the errors? Any hints would be useful.


Additionally, all of the requests come from the same user-agent shown below.

Mozilla/5.0 (Windows; U; Windows NT 5.1; pt-PT; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729)

This lead me to find the following threads: pt-BR and Strange parameter in URL - what are they trying?

5
  • such link cannot be generated from HREFs in the site itself. and it is strange that 5 different sites generated similar link in different hours of the weekend
    – Atara
    Nov 23, 2015 at 9:54
  • Okay, so why did you generate the wrong links?
    – zerkms
    Nov 23, 2015 at 10:12
  • Thats my question. I did not generate URLs with A=0 or 0+A. I wonder what did generate these URLs
    – Atara
    Nov 23, 2015 at 10:13
  • 5
    @zerkms perhaps you don't understand SQL injection scanners. It has nothing to do with the site or the code. Plethoras of VPS/compute instances constantly hit sites testing for simple injection ('A=0) or ways to run JS. If that works, they know the site is vulnerable, it is reported to the scanner OP, then scanner OP comes to work the magic. Just this week there have been 6 amazon instances hitting our networks probing, and like the comment above states, there is nothing "generating them" in code.
    – dhaupin
    Jul 6, 2016 at 13:32
  • You might also want to look into getting a reliable CDN that will proxy requests to your site, and offer basic injection protection (and other security features, like DDoS protection).
    – analytik
    Jun 25, 2017 at 10:06

2 Answers 2

33

It is a bot testing for SQL injection vulnerabilities by closing a query with apostrophe, then setting a variable. There are also similar injects that deal with shell commands and/or file path traversals. Whether it's a "good bot" or a bad bot is unknown, but if the inject works, you have bigger issues to deal with. There's a 99% chance your site is not generating these style links and there is nothing you can do to stop them from crafting those urls unless you block the request(s) with a simple regex string or a more complex WAF such as ModSecurity.

Blocking based on user agent is not an effective angle. You need to look for the request heuristics and block based on that instead. Some examples of things to look for in the url/request/POST/referrer, as both utf-8 and hex characters:

  • double apostrophes
  • double periods, especially followed by a slash in various encodings
  • words like "script", "etc" or "passwd"
  • paths like dev/null used with piping/echoing shell output
  • %00 null byte style characters used for init a new command
  • http in the url more than once (unless your site uses it)
  • anything regarding cgi (unless your site uses it)
  • random "enterprise" paths for things like coldfusion, tomcat, etc

If you aren't using a WAF, here is a regex concat that should capture many of those within a url. We use it in PHP apps, so you may/will need to tweak some escapes/looks depending on where you are using this. Note that this has .cgi, wordpress, and wp-admin along with a bunch of other stuff in the regex, remove them if you need to.

$invalid = "(\(\))"; // lets not look for quotes. [good]bots use them constantly. looking for () since technically parenthesis arent valid
$period = "(\\002e|%2e|%252e|%c0%2e|\.)";
$slash = "(\\2215|%2f|%252f|%5c|%255c|%c0%2f|%c0%af|\/|\\\)"; // http://security.stackexchange.com/questions/48879/why-does-directory-traversal-attack-c0af-work
$routes = "(etc|dev|irj)" . $slash . "(passwds?|group|null|portal)|allow_url_include|auto_prepend_file|route_*=http";
$filetypes = $period . "+(sql|db|sqlite|log|ini|cgi|bak|rc|apk|pkg|deb|rpm|exe|msi|bak|old|cache|lock|autoload|gitignore|ht(access|passwds?)|cpanel_config|history|zip|bz2|tar|(t)?gz)";
$cgis = "cgi(-|_){0,1}(bin(-sdb)?|mod|sys)?";
$phps = "(changelog|version|license|command|xmlrpc|admin-ajax|wsdl|tmp|shell|stats|echo|(my)?sql|sample|modx|load-config|cron|wp-(up|tmp|sitemaps|sitemap(s)?|signup|settings|" . $period . "?config(uration|-sample|bak)?))" . $period . "php";
$doors = "(" . $cgis . $slash . "(common" . $period . "(cgi|php))|manager" . $slash . "html|stssys" . $period . "htm|((mysql|phpmy|db|my)admin|pma|sqlitemanager|sqlite|websql)" . $slash . "|(jmx|web)-console|bitrix|invoker|muieblackcat|w00tw00t|websql|xampp|cfide|wordpress|wp-admin|hnap1|tmunblock|soapcaller|zabbix|elfinder)";
$sqls = "((un)?hex\(|name_const\(|char\(|a=0)";
$nulls = "(%00|%2500)";
$truth = "(.{1,4})=\1"; // catch OR always-true (1=1) clauses via sql inject - not used atm, its too broad and may capture search=chowder (ch=ch) for example
$regex = "/$invalid|$period{1,2}$slash|$routes|$filetypes|$phps|$doors|$sqls|$nulls/i";

Using it, at least with PHP, is pretty straight forward with preg_match_all(). Here is an example of how you can use it: https://gist.github.com/dhaupin/605b35ca64ca0d061f05c4cf423521ab

WARNING: Be careful if you set this to autoban (ie, fail2ban filter). MS/Bing DumbBots (and others) often muck up urls by entering things like strange triple dots from following truncated urls, or trying to hit a tel: link as a URi. I don't know why. Here is what i mean: A link with text www.example.com/link-too-long...truncated.html may point to a correct url, but Bing may try to access it "as it looks" instead of following the href, resulting in a WAF hit due to double dots.

2
  • As a note, if you end up using ModSecurity, set it to verbose+no-process mode first. There are more than a few rules that will try to deny Googlebot -- strangely one of them is an ip reputation rule. In no-process mode you may see the logs flooding, but not taking action, so you can disable the strict rule(s).
    – dhaupin
    Aug 8, 2016 at 15:07
  • 1
    I saw these 'A=0 on the end of my URLs also. I went through lots of code wondering what I had done to cause this, finding of course nothing. Then I checked the IP addresses, none of them are from any customer IP addresses that I recognise. It really is somebody trying injection. Sep 8, 2016 at 7:44
-9

since this is a very old version of FireFox, I blocked it in my htaccess file -

RewriteCond %{HTTP_USER_AGENT} Firefox/3\.5\.2 [NC]
RewriteRule .* err404.php  [R,L]
0

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.