4 ms·
Has anybody looked for historical Shellshock exploit traffic (in old/backed-up logfiles)? Though none of the exploits I have seen thus far look very obfuscatib
by frankzinger 12y ago
Has anybody looked for historical Shellshock exploit traffic (in old/backed-up logfiles)?
Though none of the exploits I have seen thus far look very obfuscatible and therefore probably would've been discovered already.
- LeoPanthera 12y agoYeah I did. I run a niche site that gets about a thousand hits a day. It has a cgi that uses bash. I've got logs going back to January, and the first (and so far only) attempted exploit is from shellshock-scan yesterday. It came after the first bash patch, which I had applied, and did not succeed.
- cesarb 12y agoHow complete is your log? Does it log every header, or just User-Agent? Now that the exploit is public, people don't care anymore, but anyone who knew about this bug and tried to exploit it before it was public would be careful to avoid using a commonly-logged HTTP header.
- vampolo 12y agoIs this log public available ? I would like to dig into it.
- rdrake 12y agoThis Google Doc has a list of URLs tested by the detectify.com scanner: https://docs.google.com/document/d/1vN2QOG2OZIAHGXDmd5wB8FPi-Hin2GaIlWRJ0RYkTbA/ https://docs.google.com/document/d/1vN2QOG2OZIAHGXDmd5wB8FPi...
- noonespecial 12y agoI have some truly old (disk) images going back to around 2003. I've looked through them and found nothing. What freaks me out though is that these systems were vulnerable. All this time; it was right there. Its like finding out you just drove from LA to NYC with nothing but a single loose lug nut on your left front tire.