[SOLVED] SERVER_NAME & URL not in my name space + yahoo stuff not

whoops · 2011-03-09 19:51:55

Hi!

A cheap php 404 scripts just informed me, that someone tried to access a site on my server that does not exist and:
the getenv ("REQUEST_URI") is

##censored#ip##/?login=#censored#&PASSWD=#censored#

(yes, I've got a plaintext login + password of unknown origin in there. Didn't test if it's real @ yahoo or something )

the getenv ("SERVER_NAME") is:
An IP that should definitely not be associated with my server, doesn't resolve to a host name

PORT    STATE SERVICE    VERSION
80/tcp  open  http?
443/tcp open  ssl/https?
2 services unrecognized despite returning data.

and traces back or redirects to (not sure, its sort of confusing):

something.member.something.yahoo.com

... which gets redirected to the yahoo login page where firefox gives me a "cross site scripting attempt" warning. Is this just the stuff yahoo usually does to its customers or is there someone else at work? Couldn't figure out how exactly the redirects work or in which direction and how the IP from which I got there is involved - must be more [serverside + cookie + javascript] stuff than 3-5 mad computer scientists can eat together or something.

the IP who tried to access this page according to the message definitely is noone who has anything to do with me either...

PORT     STATE    SERVICE       VERSION
135/tcp  filtered msrpc
139/tcp  filtered netbios-ssn
445/tcp  filtered microsoft-ds
1025/tcp open     msrpc         Microsoft Windows RPC
3389/tcp open     microsoft-rdp Microsoft Terminal Service
Service Info: OS: Windows

also wrong provider+country (but none of the "especially conspicuous" ones) to be likely to be in the right place. Doesn't look like a "normal hacker" either, or does it? More like bored notebook guy who doesn't know the difference between internet & network... or are windows computer supposed to look like this from outside?

Can someone give me hint? What could that mean? I feel sort of lost, my php, sever etc knowledge just isnt't that solid I guess... well, I know my "basics" are rather wobbly. Just: That's not something my server usually does.

How can getenv ("SERVER_NAME") give me something that's none of my domains / server ip's?
Can't figure out if I did something wrong... could this be something "upstream"? I transferred and registered some domains less than 20 hours ago which could explain for a period of "DNS strangeness" or something, but don't see how exactly that alone could result in something like that either... that'd be the wrong direction, right...? Argh...

Any hints are welcome - even if it's just something like: "don't panic" or "do panic, ffs!!!!!!". I'm not entirely sure if it's better to (a) just ignore that incident or (b) shut down the whole server without knowing why until I do.

Thanks!

Last edited by whoops (2011-03-10 00:27:39)

fukawi2 · 2011-03-09 22:59:59

Well there's a lot of censored information in your post which makes it difficult to understand what you're trying to explain, so a lot of your post is "TL;DR", but I think your main question is:

whoops wrote:

How can getenv ("SERVER_NAME") give me something that's none of my domains / server ip's?

SERVER_NAME is whatever the client supplies in the HTTP "Host:" header. It can be set to anything since it's set by the client. Of course if the server doesn't have configuration for the request, then it's not going to do very much.

whoops · 2011-03-10 00:26:41

Exactly, that should have been my main question - thanks!

Almost can't believe, I just used the wrong variable! Everything makes so much more sense now... I must have been getting those clumsy / harmless "attacks" for years without noticing - until I messed up that 404 log script during domain transfer.

[...]information in your post which makes it difficult to understand what you're trying to explain[...]

I know. My problem was, that I couldn't really understand what exactly my problem was, so I "postet random stuff" and it worked out

Last edited by whoops (2011-03-10 00:30:46)

Arch Linux

#1 2011-03-09 19:51:55

[SOLVED] SERVER_NAME & URL not in my name space + yahoo stuff not

#2 2011-03-09 22:59:59

Re: [SOLVED] SERVER_NAME & URL not in my name space + yahoo stuff not

#3 2011-03-10 00:26:41

Re: [SOLVED] SERVER_NAME & URL not in my name space + yahoo stuff not

Board footer