Someone using a broadband connection in Kiev, Ukraine sent this little gift today:<\/p>\n
\/var\/log\/httpd\/access_log:178.137.17.213<\/strong> – – [03\/Aug\/2011:15:34:49 -0400] “GET \/radio-show.php?show=3319++++++++++++++++++++++++++Result:+%E7%E0%F0%E5%E3%E8%F1%F2%F0%E8%F0%EE%E2%E0%EB%E8%F1%FC;+%E2%EE%F8%EB%E8;+%ED%E5+%ED%E0%F8%EB%EE%F1%FC+%F4%EE%F0%EC%FB+%E4%EB%FF+%EE%F2%EF%F0%E0%E2%EA%E8;+%E2%EE%E7%EC%EE%E6%ED%EE,+%F0%E5%E3%E8%F1%F2%F0%E0%F6%E8%FF+%ED%E5+%F3%E4%E0%EB%E0%F1%FC+%28%E2%FB%F1%EB%E0%ED+%EA%EE%E4+%E0%EA%F2%E8%E2%E0%F6%E8%E8+\/+%E8%F1%EF%EE%EB%FC%E7%F3%E5%F2%F1%FF+%E4%EE%EF%EE%EB%ED%E8%F2%E5%EB%FC%ED%E0%FF+%E7%E0%F9%E8%F2%E0+\/+%F1%E1%EE%E9+%E2+%F0%E0%E1%EE%F2%E5+%F4%EE%F0%F3%EC%E0+\/+…%29; HTTP\/1.0” 200 23809 “http:\/\/streamingradioguide.com\/radio-show.php?show=3319++++++++++++++++++++++++++Result:+%E7%E0%F0%E5%E3%E8%F1%F2%F0%E8%F0%EE%E2%E0%EB%E8%F1%FC;+%E2%EE%F8%EB%E8;+%ED%E5+%ED%E0%F8%EB%EE%F1%FC+%F4%EE%F0%EC%FB+%E4%EB%FF+%EE%F2%EF%F0%E0%E2%EA%E8;+%E2%EE%E7%EC%EE%E6%ED%EE,+%F0%E5%E3%E8%F1%F2%F0%E0%F6%E8%FF+%ED%E5+%F3%E4%E0%EB%E0%F1%FC+%28%E2%FB%F1%EB%E0%ED+%EA%EE%E4+%E0%EA%F2%E8%E2%E0%F6%E8%E8+\/+%E8%F1%EF%EE%EB%FC%E7%F3%E5%F2%F1%FF+%E4%EE%EF%EE%EB%ED%E8%F2%E5%EB%FC%ED%E0%FF+%E7%E0%F9%E8%F2%E0+\/+%F1%E1%EE%E9+%E2+%F0%E0%E1%EE%F2%E5+%F4%EE%F0%F3%EC%E0+\/+…%29;” “Mozilla\/4.0 (compatible; MSIE 5.5; Windows 95)”<\/p>\n In general, this looks like an attempt at an SQL injection attack…\u00a0 the typical one is looking to do this:<\/p>\n Request:\u00a0\u00a0\/radio-show.php?showid=123;drop table xyz<\/p>\n hoping that the coding takes in the showid and directly executes it as SQL code”<\/p>\n “Select * from radioshows where showid=123;drop table xyz”<\/p>\n the %xx stuff is encoding UTF8 (basically ASCII8) so it is harder to read.\u00a0 The sequence above makes very little sense.\u00a0\u00a0 It looks mostly like a probe to see if that particular page is vulnerable to an injection attack.\u00a0\u00a0 “+” inside a GET request becomes a space character.<\/p>\n Should you travel to China or Eastern Europe, you’ll find that this server can’t be reached.\u00a0\u00a0 This particular block of IP addresses wasn’t yet blocked.<\/p>\n If you’re curious, program #3319 is Sounds of Sinatra.\u00a0 I hear he’s big in Ukraine<\/p>\n","protected":false},"excerpt":{"rendered":" Someone using a broadband connection in Kiev, Ukraine sent this little gift today: \/var\/log\/httpd\/access_log:178.137.17.213 – – [03\/Aug\/2011:15:34:49 -0400] “GET \/radio-show.php?show=3319++++++++++++++++++++++++++Result:+%E7%E0%F0%E5%E3%E8%F1%F2%F0%E8%F0%EE%E2%E0%EB%E8%F1%FC;+%E2%EE%F8%EB%E8;+%ED%E5+%ED%E0%F8%EB%EE%F1%FC+%F4%EE%F0%EC%FB+%E4%EB%FF+%EE%F2%EF%F0%E0%E2%EA%E8;+%E2%EE%E7%EC%EE%E6%ED%EE,+%F0%E5%E3%E8%F1%F2%F0%E0%F6%E8%FF+%ED%E5+%F3%E4%E0%EB%E0%F1%FC+%28%E2%FB%F1%EB%E0%ED+%EA%EE%E4+%E0%EA%F2%E8%E2%E0%F6%E8%E8+\/+%E8%F1%EF%EE%EB%FC%E7%F3%E5%F2%F1%FF+%E4%EE%EF%EE%EB%ED%E8%F2%E5%EB%FC%ED%E0%FF+%E7%E0%F9%E8%F2%E0+\/+%F1%E1%EE%E9+%E2+%F0%E0%E1%EE%F2%E5+%F4%EE%F0%F3%EC%E0+\/+…%29; HTTP\/1.0” 200 23809 “http:\/\/streamingradioguide.com\/radio-show.php?show=3319++++++++++++++++++++++++++Result:+%E7%E0%F0%E5%E3%E8%F1%F2%F0%E8%F0%EE%E2%E0%EB%E8%F1%FC;+%E2%EE%F8%EB%E8;+%ED%E5+%ED%E0%F8%EB%EE%F1%FC+%F4%EE%F0%EC%FB+%E4%EB%FF+%EE%F2%EF%F0%E0%E2%EA%E8;+%E2%EE%E7%EC%EE%E6%ED%EE,+%F0%E5%E3%E8%F1%F2%F0%E0%F6%E8%FF+%ED%E5+%F3%E4%E0%EB%E0%F1%FC+%28%E2%FB%F1%EB%E0%ED+%EA%EE%E4+%E0%EA%F2%E8%E2%E0%F6%E8%E8+\/+%E8%F1%EF%EE%EB%FC%E7%F3%E5%F2%F1%FF+%E4%EE%EF%EE%EB%ED%E8%F2%E5%EB%FC%ED%E0%FF+%E7%E0%F9%E8%F2%E0+\/+%F1%E1%EE%E9+%E2+%F0%E0%E1%EE%F2%E5+%F4%EE%F0%F3%EC%E0+\/+…%29;” “Mozilla\/4.0 (compatible; MSIE 5.5; Windows 95)” In general, this looks like an attempt at an SQL … Continue reading