Hacker Showing Up in My Log Files,.But How

[BlackRaven]

Ok recently found that my apache logs has a username that i did not use. I am wondering how this person was ablt to log in? Double checked all my .htaccess user name, found nothing, all my sective folders have deny all execept home ip and dedicated server ip in .htaccess. Is there something with the HTTP/1.0 i am not aware of. Thank you.

**.**.**.** - mrhacker [28/Oct/2005:11:45:52 -0600] "GET / HTTP/1.0" 200 17565 "http://***.**/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"

[jdMorgan]

First of all, do you know for a fact that this person is actually "logged in"? The request you show is for your home page "/". Does that page actually require a user to be logged in? (that would be highly unusual, since it would make it hard for people to ever sign up on your site...)

The reason I'm asking is that it's possible that this person has simply 'hacked' his own browser, so that it sends the REMOTE_USER header when it hasn't even been asked to do so. This could make it appear that he's logged-in, when he's actually just sending a spurious HTTP request header. Or maybe the user is innocent, and someone (or a trojan) hacked his/her browser to send this header.

Look in your logs for a 401-Unauthorized challenge-response 'session', where he requests a page that you *know* requires a login, gets a 401-Unauthorized server response, and then you see a line with the username, the same page requested, and a 200-OK or 304-Not Modified server response. That would be more worrisome than the single request for "/" that you show.

Something like this:

192.168.0.1 - - [28/Oct/2005:20:43:19 -0400] "GET /your_secured_page HTTP/1.1" [b]401[/b] - "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7"
192.168.0.1 - mrHacker [28/Oct/2005:20:43:25 -0400] "GET /your_secured_page HTTP/1.1" [b]200[/b] 1911 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7"

Jim

[BlackRaven]

thanks for the reply jdMorgan,
firstly no my homepage does not require any login, secondly i double checked all my error logs and wasnt able to find anything **knock on wood. However while searching on the web i stublmded upon this site.

<snip>

Just curious how would one protect their temp folder from this kinda of attack. Thank you

[edited by: jdMorgan at 4:42 am (utc) on Oct. 29, 2005]
[edit reason] No URLs, please. See TOS. [/edit]

[jdMorgan]

There's no threat there. The guy just discusses how to pretend you are a browser. It's about as useful as sending messages using Morse code these days -- fun for about ten minutes, but not real useful in an age of e-mail and cell phones.

I'm being too critical; The manual server-request technique is occasionally useful in diagnosing server config problems. But there is no 'hacking' secret there.

If you'd like an authoritative discussion of HTTP, see RFC2616 - HTTP/1.1 Protocol [w3.org]. (Links to primarily non-commercial, third-party, authoritative sites or very-widely-known sites such as google.com or the BBC *are* allowed here).

Jim