New Unfriendly U-A and Request URI

Is this an attempted server exploit?

[Wizcrafts]

Greetings;

I found this cryptic entry in my logs from last night:

61.135.***.173 - - [26/Aug/2004:03:41:07 -0400] "GET /~!^~!^~!.html HTTP/1.1" 404 657 "-" "google"

The IP is Chinese, and has no affiliation with the real Google. The request threw a 404 in my logs, but when I dropped it into my browser I got a message saying "Server File Not Found," instead of my custom 404 page. The server is a RAQ4 running Linux.

Is this a new server hacking attempt, or a known exploit that I am just seeing for the first time?

I have just blocked this ISP's entire IP range, but I'm concerned about the nature of the Requested URI. Any input will be appreciated. Google reveals nothing about this URI.

Wiz

[edited by: volatilegx at 10:57 pm (utc) on Aug. 26, 2004]
[edit reason] obscured IP [/edit]

[photoace]

It hit me as well. I have the entire ip 61. blocked and somehow the server return a 404 and not a 403. Any "~" following the root "/" sends my server to users subdirectory. Maybe looking for some user accounts exploits on the server. Just as puzzled as you are. Would like to know more, maybe in the apache forum we might find help.

[volatilegx]

Just for kicks, I used that filename to make a request to my website. I noticed that the ^ character was converted to %5E by my browser (Firefox .8), making the filename ~!%5E~!%5E~!.html

Of course, the above may be totally irrelevent :)

[Wizcrafts]

I also asked this question in the Apache Webserver forum, here: [webmasterworld.com...]

So far nobody there has an answer for what hack is being attempted. I like the idea that was posted here about sub-user accounts beginning with a tilde, as a possible exploit attempt. We do need to find out what these people are up to.

Wiz

[Lord Majestic]

"GET /~!^~!^~!.html HTTP/1.1"

~!^ are so called "unsafe" characters and should not be used in URLs without encoding. Why are they called "unsafe"? Because "Some characters present the possibility of being misunderstood within URLs for various reasons. These characters should also always be encoded."

Its not a hack - just some error in testing bot or something like this. Or maybe some error converting Unicode (Chinese) to ASCII.

[Wizcrafts]

Oh, I see now. Somebody in China is testing a new Bot, which they have named "google" and because they are so new in the business they haven't learned yet how to translate their typed alphabet into a unicode character set. They just happened to be browsing the Internet and found our sites by accident, then, instead of requesting / (the default root file) they asked for some untranslatable file, with "unsafe" characters, but, mysteriously ending in the readable .html? I don't buy it.

Besides, if it is a search bot, it didn't request Robots.txt, like most SEs do. It only asked for that one "unsafe" filename, got a server 404, and went away (to visit JD's website).

Wiz

[Lord Majestic]

Filename looks pretty safe to me, its just characters called unsafe. Anything could have happened, you will probably never know what, it does not look like a hack attempt unless you know specific problem with Apache losing it when "/~!^~!^~!.html" is requested. Just relax and let it go - strange things happen on the Internet and many of those things mean nothing and therefore not worth losing good night sleep over.

[jdMorgan]

to visit JD's website

Yeah, it did indeed come by after you kicked it out, but was rejected as a Googlebot spoof.

61.135.***.173 - - [26/Aug/2004:12:33:31 -0500] "GET /~!^~!^~!.html HTTP/1.1" 403 646 "-" "google"

Hopefully it's just a badly-coded junk robot stuck in a loop, and not a specific exploit attempt. If it was indeed something bad, I suspect we'd have heard about it on some of the security sites by now.

Jim