Hacker News Reader

Comment by ge96 | Hacker News Reader

Yeah I don't use Wordpress but I just happened to see them looking at logs.

I am worried because I don't know. I covered some basics like SSL, XSS (htmlescape), sessions are redirect related, PDO/sql... no ddos/load balance... backup backup

View on HN

That is what we like to call the background noise of the internet. Scanners are always scanning. Try this as an experiment sometime: make a brand new instance on your favorite cloud provider, and just run tcpdump on it for a few hours. You'll see all kinds of cool things: from people scanning for HTTP, Telnet, people scanning for SSH servers with weak passwords, router exploits with shellcode embedded in a UDP packet, back-scatter from DDoS attacks, cool stuff. Honestly looking at each packet and trying to figure out what's going on is a pretty great way to learn.

I did trace one of them and it lead to some "what appears to be" fake cloud provider. It had a cliche login form/company name but it didn't seem legit.

I'm not sure if it's possible to "bounce off" an attack from someone else's ip, by "attack" I mean a specific requested URL that is looking for an exploit.

URLs don't request things on the internet, IPs do.

This may also be a good read:

https://en.wikipedia.org/wiki/Reflection_attack

Thanks for the clarification and the good read.

If you want to study the background noise, I think you would have better luck reacting to it - as well as running tcpdump, set up a trivial HTTP and SSH server and observe the interactions.

I'll have to lookup TCP dump, I wrote a basic ip-incoming-request tracker and also sometimes see the error log.

it is crazy to just randomly try different octet combinations to form a new ip and see what you get... what about ipv6 hoho

thanks

Reply on news.ycombinator.com