<div dir='auto'>First thought: what other hits come from that IP address previously? Could it be Redirect or rewrite?<div dir="auto">-Adam</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Feb. 17, 2020 16:29, Trevor Cordes <trevor@tecnopolis.ca> wrote:<br type="attribution" /><blockquote class="quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><p dir="ltr">I have a mystery hit on my apache server that is giving weird results that
<br>
by config should never happen... and I can't figure it out. What's
<br>
happening is very rarely a hit will "break out" of the dirs that I think
<br>
all hits should be limited to. And I can't reproduce it with telnet
<br>
tests.
<br>
<br>
Somehow a hit is getting access to /var/www/html/ when that should be
<br>
impossible. Yes, it's my document root in the global area, but
<br>
immediately in my virtualhost for that IP and port I redefine docroot to
<br>
a sub dir of that. There should be no way someone can hit the site and
<br>
get to the original docroot.
<br>
<br>
Yes, I am probably going to change the default global docroot to just be
<br>
the same as my subdir one in the virthost, but I really want to figure out
<br>
why the request can break out the way it is.
<br>
<br>
The only thing weird about the hit, based on my customized logging
<br>
details, is that they are hitting a ServerAlias of the virthost, which is
<br>
a bit odd because that particular alias isn't public knowledge (though
<br>
it's not really hidden either). Oh ya, and the IP is in HK and is trying
<br>
fuzzing attacks again me.
<br>
<br>
Here's the hit (IPs/hostnames changed):
<br>
1.2.3.4 - - [17/Feb/2020:02:40:07 -0600] "GET / HTTP/1.1" 403 199 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0" 80 9-w1.foo.com /var/www/html/
<br>
<br>
Note port 80, note the serveralias they hit us with, note the resulting
<br>
directory /var/www/html
<br>
<br>
Here's the error it generates:
<br>
[Mon Feb 17 14:43:13.444291 2020] [autoindex:error] [pid 16365:tid 140334311606016] [client 2.3.4.5:54603] AH01276: Cannot serve directory /var/www/html/: No matching DirectoryIndex (index.phtml,index.html,index.phtml,index.php) found, and server-generated directory index forbidden by Options directive
<br>
<br>
It's ok it's forbidden (in fact, might have saved my bacon) as I have
<br>
dirindex forbidden globally. The thing is no hit should ever be trying to
<br>
find a index.html in /var/www/html!
<br>
<br>
When I try to recreate the hit to match the above manually with telnet, no
<br>
matter what I do I can't get the serveralias to match their hit:
<br>
<br>
telnet foo.com
<br>
GET / HTTP/1.1
<br>
Host: 9-w1.foo.com
<br>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
<br>
<br>
Gives me a log result which matches what I expect the correct behaviour to
<br>
be:
<br>
<br>
50.71.247.87 - - [17/Feb/2020:15:48:21 -0600] "GET / HTTP/1.1" 302 136 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0" 80 www.foo.com proxy:fcgi://localhost/var/www/html/Foo/Live/index.phtml
<br>
<br>
What on earth are the other parameters or headers they are passing in that
<br>
results in a different result than my test? I'm truly stumped. I could
<br>
try to capture packets of a hit, but the "attacks" only happen 2-3 times a
<br>
day and always from different IPs in Asia.
<br>
_______________________________________________
<br>
Roundtable mailing list
<br>
Roundtable@muug.ca
<br>
https://muug.ca/mailman/listinfo/roundtable
<br>
</p>
</blockquote></div><br></div>