Welcome to WebmasterWorld Guest from 54.234.13.175

Forum Moderators: Ocean10000 & keyplyr

Message Too Old, No Replies

shodan - user-agent, proxy, referer

chr characters included in X_FORWARDED_FOR

     
2:59 pm on Jun 11, 2016 (gmt 0)

Senior Member from GB 

WebmasterWorld Senior Member dstiles is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:May 14, 2008
posts:3208
votes: 17


Saw this yesterday and discovered I hadn't deliberately trapped it, though Windows trapped the proxy part on its own.

X_Forwaded_For:
148.33.76.24[CHR(0)]shodanscanprint(chr(49).chr(55).chr(73).chr(53).chr(51).chr(48).chr(86).chr(65).chr(117).chr(52));, 10.3.124.25

This is illegal syntax (should be only IPs, commas and spaces). Caught by Windows 12 server (returned 400 code) but not by some earlier Windows. No idea about Apache/linux.

User-Agent:
Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.8.1.6) Gecko/20070817 IceWeasel/2.0.0.6-g3shodanscanprint(chr(49).chr(55).chr(73).chr(53).chr(51).chr(48).chr(86).chr(65).chr(117).chr(52));

Referer:
[google.com...]

The chr values as shown are: 1.7.I.5.3.0.V.A.u.4
No idea what they would do but no doubt some kind of exploit. :(

Source was a single IP in Russian hosting: 178.210.64.0 - 178.210.95.255
10:38 pm on June 11, 2016 (gmt 0)

Moderator This Forum from US 

WebmasterWorld Administrator keyplyr is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:Sept 26, 2001
posts:12913
votes: 890


Source was a single IP in Russian hosting: 178.210.64.0 - 178.210.95.255

Haven't seen this one, thanks
nic.ru hosting
178.210.64.0 - 178.210.95.255
178.210.64.0/20
11:18 pm on June 11, 2016 (gmt 0)

Senior Member from US 

WebmasterWorld Senior Member lucy24 is a WebmasterWorld Top Contributor of All Time 5+ Year Member Top Contributors Of The Month

joined:Apr 9, 2011
posts:15257
votes: 692


This is illegal syntax (should be only IPs, commas and spaces).

Ah, good tip. My existing rule only specifies

X-Forwarded-For ^(unknown|\W)

although frankly I don't even understand how you can x-forward-for more than one IP at the same time, which manifestly does occur.
4:43 pm on June 13, 2016 (gmt 0)

Senior Member from GB 

WebmasterWorld Senior Member dstiles is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:May 14, 2008
posts:3208
votes: 17


I had a similar trap failure: checking for IPs split on a comma without making sure all items WERE IPs.

> x-forward-for more than one IP

It's common for one of the IPs to be a local one - 192.168, 10 etc. Probably a firewall with a DMZ and proxy running through it. Other IPs could be introduced by THAT mechansim working via (eg) a google proxy, so that could make 3 IPs; 4 if the secondary proxy has a local IP involved.

That's my take on it, anyway. :)
10:06 pm on June 13, 2016 (gmt 0)

Senior Member from US 

WebmasterWorld Senior Member lucy24 is a WebmasterWorld Top Contributor of All Time 5+ Year Member Top Contributors Of The Month

joined:Apr 9, 2011
posts:15257
votes: 692


:: rewind ::

X_Forwaded_For

Was that a posting typo, or the actual header name? I haven't met that form, but I have a global ban on
X-Fowarded-For [sic]
and a couple of other attested misspellings. (Also one correctly spelled header that I've never seen from anyone but a robot. Maybe it's something human browsers used in 1995.)
1:21 pm on June 14, 2016 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month

joined:Dec 27, 2004
posts:1964
votes: 65


I was watching our Sun Set when I got an email from my firewall - almost chocked on a cold one at that point.

WTF is X-Varnish header?

and X-PIPER-ID? Are we in Silicon Valey now?
2:59 pm on June 15, 2016 (gmt 0)

Senior Member from GB 

WebmasterWorld Senior Member dstiles is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:May 14, 2008
posts:3208
votes: 17


Lucy - typo. Sorry. That's my internal version, since the software gets confused by hyphens.

Blend27 - isn't X-Varnish Polish and X_PIPER from the gates of dawn? :)
 

Join The Conversation

Moderators and Top Contributors

Hot Threads This Week

Featured Threads

Free SEO Tools

Hire Expert Members