phpBB.de

Verfasst: **19.03.2010 22:17**

Hallo,

es passt nicht wirklich in diese Kategorie aber ich wusste nicht genau wohin. Falls es woanders besser aufgehoben ist, bitte verschieben. Danke.

Meine Frage: Also dass dieser liebe Gast nichts Gutes im Sinn hatte scheint mir so aber was genau hat er da getan, kann mir das jemand erklären?

Auszug aus dem Logfile

"GET /viewtopic.php?f=3&t=638&p=49290%27%20aND%20%278%27%3D%273 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
"GET /viewtopic.php?f=3&t=638&p=49290%09aND%098%3D8 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
"GET /viewtopic.php?f=3&t=638&p=49290%09aND%098%3D3 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
"GET /viewtopic.php?f=3&t=638&p=49290%27%09aND%09%278%27%3D%278 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
"GET /viewtopic.php?f=3&t=638&p=49290/**/aND/**/8%3D8 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
"GET /viewtopic.php?f=3&t=638&p=49290/**/aND/**/8%3D3 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
"GET /viewtopic.php?f=3&t=638&p=49290%27/**/aND/**/%278%27%3D%278 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
"GET /viewtopic.php?f=3&t=638&p=49290%27/**/aND/**/%278%27%3D%273 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
"GET /viewtopic.php?f=3&t=638&p=49290%25%27%20aND%20%278%25%27%3D%278 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
"GET /viewtopic.php?f=3&t=638&p=49290%25%27%20aND%20%278%25%27%3D%273 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
"GET /viewtopic.php?f=3&t=638&p=49290%25%27%09aND%09%278%27%3D%278 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
"GET /viewtopic.php?f=3&t=638&p=49290%25%27%09aND%09%278%25%27%3D%273 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
"GET /viewtopic.php?f=3&t=638&p=49290%25%27/**/aND/**/%278%27%3D%278 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
"GET /viewtopic.php?f=3&t=638&p=49290%25%27/**/aND/**/%278%25%27%3D%273 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
"GET /viewtopic.php?f=3&t=638&p=49290%20XoR%208%3D3 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
"GET /viewtopic.php?f=3&t=638&p=49290%20XoR%208%3D8 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
"GET /viewtopic.php?f=3&t=638&p=49290%09XoR%098%3D3 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
"GET /viewtopic.php?f=3&t=638&p=49290%09XoR%098%3D8 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"

...

"GET /viewtopic.php?f=3&t=638&p=49290%27%20XoR%20%278%27%3D%273 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
"GET /viewtopic.php?f=3&t=638&p=49290%27%20XoR%20%278%27%3D%278 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
"GET /viewtopic.php?f=3&t=638&p=49290%27%09XoR%09%278%27%3D%273 HTTP/1.1" 200 52686 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"

Verfasst: **19.03.2010 22:50**

Ich bin mir zwar nicht sicher aber ich glaube das heißt das ein Gast immer GET Eingaben in die Browserleiste eingegeben hat, die nicht exestieren.

Verfasst: **19.03.2010 23:00**

Aufrufen geht. Was mich stutzig macht ist das 'aND' und 'XoR'.

Verfasst: **21.03.2010 10:35**

Hallo,

das könnte ein automatischer Versuch gewesen zu sein um eine SQL Injection durchzuführen.

49290/**/aND/**/8%3D8

49290 aND 8 = 8

phpBB.de

Logfiles, bitte um Erklärung

Logfiles, bitte um Erklärung

Re: Logfiles, bitte um Erklärung

Re: Logfiles, bitte um Erklärung

Re: Logfiles, bitte um Erklärung