Home / server / Questions / 123228
In Process
Byran Zaugg
Asked: 2010-03-17 17:37:22 +0800 CST

(200 ok) ACCEPTED - Is this a hacking attempt?

  • 772

I assume this is some type of hacking attempt. I've try to Google it but all I get are sites that look like they have been exploited already.

I'm seeing requests to one of my pages that looks like this.

/listMessages.asp?page=8&catid=5+%28200+ok%29+ACCEPTED

The '(200 ok) ACCEPTED' is what is odd. But it does not appear to do anything.

I'm running on IIS 5 and ASP 3.0. Is this "hack" meant for some other type of web server?

Edit:

Normal requests look like:

/listMessages.asp?page=8&catid=5
exploit http security hacking vulnerabilities

8 Answers

    1. May be the log is wrong. It looks like some part of answer inside URL. If it appears in IIS logs, try to watch the request URL using packet sniffer to ensure it is really such.
    2. May be some script gets malformed URL, e.g. it may be bug in your ASP site.

    In general it may look like either highly specific or specially crafted crack attempt that is made to look like a bug, but I suppose it is not. You should also analyse previous and further requests from this user. If it is sometimes occur from different places with no other suspicious things, it is a bug, not crack attempts.

    • 2

  2. Are all the requests coming from one IP range? Have you tried running a packet capture to see what the full request headers look like?

    • 2

  3. Only worthwhile result on Google is this, so ...

    Just had this show up on an IIS 6 (Server 2003) site I manage. In this particular case, hitting a ColdFusion page (basic template file which is used across the site, including the home page), and just tacking it on to the end of the URI stem (no query string).

    Same request, coming from a number of different IPs, with the following user-agent common amongst them:

    Mozilla/3.0 (x86 [en] Windows NT 5.1; Sun)

    No referrer information passed. 21 requests over 2 minutes, with a little over half a dozen unique IPs. Countries returned for IP include US, Bosnia, Malaysia, etcetera.

    • 2

  4. I find those entries very interesting (and not in a good way).

    /listMessages.asp?page=8&catid=5+%28200+ok%29+ACCEPTED

    The basic breakdown of this from a program standpoint gives the following variables:

    page = 8
catid = "5 " + chr(28) + "200 ok" + chr(29) + " ACCEPTED"

    The catid variable is being corrupted here. ASCII code 28 is File Separator, and code 29 is Group Separator.

    If possible, I would check processing of the catid variable, and otherwise ignore it if the program handles it correctly (and rejects it).

    • 2

  5. Here too several attempts during the Easter.

    /+%28200+ok%29+ACCEPTED

    (200 ok) ACCEPTED

    This seems to be random checks against servers.

    The IP can be found at the database of Stopforumspam.

    http://www.stopforumspam.com/

    • 2

  6. I'm getting the same kind of request on a site running classic ASP on IIS 7. The IP addresses I'm tracing all originate with spammers. I also have no idea what they are trying to do, and it does not affect the site adversely other than to annoy us with 404 errors.

    As for 200 OK Accepted, it's an HTTP status code: http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html

    • 1

  7. I don't have sufficient privileges to comment, but I get this as well, with the browser string:

    User agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; Alexa Toolbar; (R1 1.5))
IP address: 94.45.33.18

    This is against an Apache server. I don't think it's an attack as it's too infrequent and it wouldn't cause a problem on any HTTP server I can think of, except throw 404 errors.

    • 1

  8. Short answer, it may be. But given the information you give us I would say no. More logs could change the answer.

    • 0