Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Replies 4 replies
  • Subscribers 0 subscribers
  • Views 960 views
  • Users 0 members are here
Options
Suggested

[8.281][QUESTION][ANSWERED] Question: What causes this error

Billybob
Hi, I have reverse proxy setup with url hardening. I was browsing through my reverse proxy logs a few days ago and noticed that somebody was trying random search for common servers but the server was replying with a 500 error to certain requests. The regular requests were served without any problems.
2011:11:18-11:28:22 gatekeeper reverseproxy: [Fri Nov 18 11:28:22 2011] [error] [client 62.75.178.29] mod_url_hardening_request_filter(): Unexpected error: String unparsed_uri 'http://**.**.32.68:80/mysqlmanager/' doesn't start with a slash
2011:11:18-11:28:22 gatekeeper reverseproxy: srcip="62.75.178.29" localip="**.**.32.68" size="0" user="-" host="62.75.178.29" method="HEAD" statuscode="500" reason="-" extra="-" time="86370" url="/mysqlmanager/" server="mydomain.com" referer="-" cookie="-" set-cookie="-"
2011:11:18-11:28:22 gatekeeper reverseproxy: [Fri Nov 18 11:28:22 2011] [error] [client 62.75.178.29] mod_url_hardening_request_filter(): Unexpected error: String unparsed_uri 'http://**.**.32.68:80/php-myadmin/' doesn't start with a slash
2011:11:18-11:28:22 gatekeeper reverseproxy: srcip="62.75.178.29" localip="**.**.32.68" size="0" user="-" host="62.75.178.29" method="HEAD" statuscode="500" reason="-" extra="-" time="86081" url="/php-myadmin/" server="mydomain.com" referer="-" cookie="-" set-cookie="-"
2011:11:18-11:28:23 gatekeeper reverseproxy: [Fri Nov 18 11:28:23 2011] [error] [client 62.75.178.29] mod_url_hardening_request_filter(): Unexpected error: String unparsed_uri 'http://**.**.32.68:80/webadmin/' doesn't start with a slash
2011:11:18-11:28:23 gatekeeper reverseproxy: srcip="62.75.178.29" localip="**.**.32.68" size="0" user="-" host="62.75.178.29" method="HEAD" statuscode="500" reason="-" extra="-" time="84828" url="/webadmin/" server="mydomain.com" referer="-" cookie="-" set-cookie="-"
2011:11:18-11:28:23 gatekeeper reverseproxy: [Fri Nov 18 11:28:23 2011] [error] [client 62.75.178.29] mod_url_hardening_request_filter(): Unexpected error: String unparsed_uri 'http://**.**.32.68:80/sqlweb/' doesn't start with a slash
2011:11:18-11:28:25 gatekeeper reverseproxy: [Fri Nov 18 11:28:25 2011] [error] [client 62.75.178.29] mod_url_hardening_request_filter(): Unexpected error: String unparsed_uri 'http://**.**.32.68:80/mysqladmin/' doesn't start with a slash
2011:11:18-11:28:25 gatekeeper reverseproxy: srcip="62.75.178.29" localip="**.**.32.68" size="0" user="-" host="62.75.178.29" method="HEAD" statuscode="500" reason="-" extra="-" time="85069" url="/mysqladmin/" server="mydomain.com" referer="-" cookie="-" set-cookie="-"
2011:11:18-11:28:25 gatekeeper reverseproxy: [Fri Nov 18 11:28:25 2011] [error] [client 62.75.178.29] mod_url_hardening_request_filter(): Unexpected error: String unparsed_uri 'http://**.**.32.68:80/mysql-admin/' doesn't start with a slash
2011:11:18-11:28:25 gatekeeper reverseproxy: srcip="62.75.178.29" localip="**.**.32.68" size="0" user="-" host="62.75.178.29" method="HEAD" statuscode="500" reason="-" extra="-" time="85997" url="/mysql-admin/" server="mydomain.com" referer="-" cookie="-" set-cookie="-"
2011:11:18-11:28:25 gatekeeper reverseproxy: [Fri Nov 18 11:28:25 2011] [error] [client 62.75.178.29] mod_url_hardening_request_filter(): Unexpected error: String unparsed_uri 'http://**.**.32.68:80/admin/phpmyadmin/' doesn't start with a slash
2011:11:18-11:28:25 gatekeeper reverseproxy: srcip="62.75.178.29" localip="**.**.32.68" size="0" user="-" host="62.75.178.29" method="HEAD" statuscode="500" reason="-" extra="-" time="85477" url="/admin/phpmyadmin/" server="mydomain.com" referer="-" cookie="-" set-cookie="-"
2011:11:18-11:28:26 gatekeeper reverseproxy: [Fri Nov 18 11:28:26 2011] [error] [client 62.75.178.29] mod_url_hardening_request_filter(): Unexpected error: String unparsed_uri 'http://**.**.32.68:80/admin/phpMyAdmin/' doesn't start with a slash
2011:11:18-11:28:26 gatekeeper reverseproxy: srcip="62.75.178.29" localip="**.**.32.68" size="0" user="-" host="62.75.178.29" method="HEAD" statuscode="500" reason="-" extra="-" time="85136" url="/admin/phpMyAdmin/" server="mydomain.com" referer="-" cookie="-" set-cookie="-"
2011:11:18-11:28:26 gatekeeper reverseproxy: [Fri Nov 18 11:28:26 2011] [error] [client 62.75.178.29] mod_url_hardening_request_filter(): Unexpected error: String unparsed_uri 'http://**.**.32.68:80/admin/sysadmin/' doesn't start with a slash
2011:11:18-11:28:26 gatekeeper reverseproxy: srcip="62.75.178.29" localip="**.**.32.68" size="0" user="-" host="62.75.178.29" method="HEAD" statuscode="500" reason="-" extra="-" time="85211" url="/admin/sysadmin/" server="mydomain.com" referer="-" cookie="-" set-cookie="-"
2011:11:18-11:28:27 gatekeeper reverseproxy: [Fri Nov 18 11:28:27 2011] [error] [client 62.75.178.29] mod_url_hardening_request_filter(): Unexpected error: String unparsed_uri 'http://**.**.32.68:80/admin/sqladmin/' doesn't start with a slash
2011:11:18-11:28:27 gatekeeper reverseproxy: srcip="62.75.178.29" localip="**.**.32.68" size="0" user="-" host="62.75.178.29" method="HEAD" statuscode="500" reason="-" extra="-" time="85105" url="/admin/sqladmin/" server="mydomain.com" referer="-" cookie="-" set-cookie="-"
2011:11:18-11:28:27 gatekeeper reverseproxy: [Fri Nov 18 11:28:27 2011] [error] [client 62.75.178.29] mod_url_hardening_request_filter(): Unexpected error: String unparsed_uri 'http://**.**.32.68:80/admin/db/' doesn't start with a slash
2011:11:18-11:28:27 gatekeeper reverseproxy: srcip="62.75.178.29" localip="**.**.32.68" size="0" user="-" host="62.75.178.29" method="HEAD" statuscode="500" reason="-" extra="-" time="85645" url="/admin/db/" server="mydomain.com" referer="-" cookie="-" set-cookie="-"
2011:11:18-11:28:27 gatekeeper reverseproxy: [Fri Nov 18 11:28:27 2011] [error] [client 62.75.178.29] mod_url_hardening_request_filter(): Unexpected error: String unparsed_uri 'http://**.**.32.68:80/admin/web/' doesn't start with a slash
2011:11:18-11:28:28 gatekeeper reverseproxy: srcip="62.75.178.29" localip="**.**.32.68" size="0" user="-" host="62.75.178.29" method="HEAD" statuscode="500" reason="-" extra="-" time="85520" url="/admin/pMA/" server="mydomain.com" referer="-" cookie="-" set-cookie="-"
2011:11:18-11:28:28 gatekeeper reverseproxy: [Fri Nov 18 11:28:28 2011] [error] [client 62.75.178.29] mod_url_hardening_request_filter(): Unexpected error: String unparsed_uri 'http://**.**.32.68:80/mysql/pma/' doesn't start with a slash
2011:11:18-11:28:28 gatekeeper reverseproxy: srcip="62.75.178.29" localip="**.**.32.68" size="0" user="-" host="62.75.178.29" method="HEAD" statuscode="500" reason="-" extra="-" time="84957" url="/mysql/pma/" server="mydomain.com" referer="-" cookie="-" set-cookie="-"
2011:11:18-11:28:29 gatekeeper reverseproxy: [Fri Nov 18 11:28:29 2011] [error] [client 62.75.178.29] mod_url_hardening_request_filter(): Unexpected error: String unparsed_uri 'http://**.**.32.68:80/mysql/db/' doesn't start with a slash
2011:11:18-11:28:29 gatekeeper reverseproxy: srcip="62.75.178.29" localip="**.**.32.68" size="0" user="-" host="62.75.178.29" method="HEAD" statuscode="500" reason="-" extra="-" time="85985" url="/mysql/db/" server="mydomain.com" referer="-" cookie="-" set-cookie="-"
2011:11:18-11:28:29 gatekeeper reverseproxy: [Fri Nov 18 11:28:29 2011] [error] [client 62.75.178.29] mod_url_hardening_request_filter(): Unexpected error: String unparsed_uri 'http://**.**.32.68:80/mysql/web/' doesn't start with a slash
2011:11:18-11:28:32 gatekeeper reverseproxy: [Fri Nov 18 11:28:32 2011] [error] [client 62.75.178.29] mod_url_hardening_request_filter(): Unexpected error: String unparsed_uri 'http://**.**.32.68:80/sql/webadmin/' doesn't start with a slash

I restarted the reverse proxy and tested again and was denied as expected with the correct errors in the log
2011:11:19-13:24:03 gatekeeper reverseproxy: [Sat Nov 19 13:24:03 2011] [warn] long lost child came home! (pid 11963)
2011:11:19-13:27:06 gatekeeper reverseproxy: [Sat Nov 19 13:27:06 2011] [error] [client 75.149.122.188] Hostname in HTTP request (**.**.32.68) does not match the server name (www. mydomain.com)
2011:11:19-13:27:06 gatekeeper reverseproxy: srcip="75.149.122.188" localip="**.**.32.68" size="184" user="-" host="75.149.122.188" method="GET" statuscode="403" reason="-" extra="-" time="331705" url="/mysql/admin/" server="www.mydomain.com" referer="-" cookie="-" set-cookie="-"
2011:11:19-13:28:18 gatekeeper reverseproxy: [Sat Nov 19 13:28:18 2011] [error] [client 75.149.122.188] Hostname in HTTP request (**.**.32.68) does not match the server name (www .mydomain.com)
2011:11:19-13:28:18 gatekeeper reverseproxy: srcip="75.149.122.188" localip="**.**.32.68" size="189" user="-" host="75.149.122.188" method="GET" statuscode="403" reason="-" extra="-" time="76710" url="/mysql/sqlmanager/" server="www.mydomain.com" referer="-" cookie="-" set-cookie="-"

My backend server didn't get any requests but I was concerned initially. Any ideas?
Regards
Bill
Parents
  • 0
    Hi Billybob,

    Did you notice that the first quoted log is a bunch of "HEAD" requests, and the second quoted log a bunch of "GET" requests? Are you still able to reproduce the 'Unexpected error'? If yes, can you please disclose me the complete log in a private message?

    Regards,
    mlenk
  • 0 in reply to mle
    Did you notice that the first quoted log is a bunch of "HEAD" requests, and the second quoted log a bunch of "GET" requests? 

    That is why you are a developer and I try to test when I get a chance[:P] The requests in the first log are from a real source (62.75.178.29; someone in germany??). I was trying to reproduce using a regular browser in the second log with no luck so I don't know if he ran some special script that sent the "HEAD" requests.

    I don't get many queries like this at home so probably won't get it again.

    Thanks for the reply.
    Regards
    Bill.
Reply
  • 0 in reply to mle
    Did you notice that the first quoted log is a bunch of "HEAD" requests, and the second quoted log a bunch of "GET" requests? 

    That is why you are a developer and I try to test when I get a chance[:P] The requests in the first log are from a real source (62.75.178.29; someone in germany??). I was trying to reproduce using a regular browser in the second log with no luck so I don't know if he ran some special script that sent the "HEAD" requests.

    I don't get many queries like this at home so probably won't get it again.

    Thanks for the reply.
    Regards
    Bill.
Children
  • 0 in reply to Billybob
    Hi Bill,

    The requests in the first log are from a real source (62.75.178.29; someone in germany??). I was trying to reproduce using a regular browser in the second log with no luck so I don't know if he ran some special script that sent the "HEAD" requests.


    Okay, if this is the case I guess the WAF blocked some blind scans for vulnerabilities of some sort of publically-exposed MySQL administration tool. The requests have correctly been blocked (the line following the error message always has statuscode="500"). So, as long as your legitimate website visitors don't have a problem, I would considere these log entries not an issue.

    Regards,
    mlenk
Unfiltered HTML