Hacker News Reader

Comment by vbezhenar | Hacker News Reader

There are bots who mindlessly throwing HTTP requests on some known vulnerabilities, they don't really check whether you're running wordpress or not. Every web server bombarded by those requests, that's not something you should be worried about.

View on HN

Yeah I don't use Wordpress but I just happened to see them looking at logs.

I am worried because I don't know. I covered some basics like SSL, XSS (htmlescape), sessions are redirect related, PDO/sql... no ddos/load balance... backup backup

That is what we like to call the background noise of the internet. Scanners are always scanning. Try this as an experiment sometime: make a brand new instance on your favorite cloud provider, and just run tcpdump on it for a few hours. You'll see all kinds of cool things: from people scanning for HTTP, Telnet, people scanning for SSH servers with weak passwords, router exploits with shellcode embedded in a UDP packet, back-scatter from DDoS attacks, cool stuff. Honestly looking at each packet and trying to figure out what's going on is a pretty great way to learn.

If you want to study the background noise, I think you would have better luck reacting to it - as well as running tcpdump, set up a trivial HTTP and SSH server and observe the interactions.

I'll have to lookup TCP dump, I wrote a basic ip-incoming-request tracker and also sometimes see the error log.

it is crazy to just randomly try different octet combinations to form a new ip and see what you get... what about ipv6 hoho

thanks

I did trace one of them and it lead to some "what appears to be" fake cloud provider. It had a cliche login form/company name but it didn't seem legit.

I'm not sure if it's possible to "bounce off" an attack from someone else's ip, by "attack" I mean a specific requested URL that is looking for an exploit.

URLs don't request things on the internet, IPs do.

This may also be a good read:

https://en.wikipedia.org/wiki/Reflection_attack

Thanks for the clarification and the good read.

Reply on news.ycombinator.com